Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.39.16, 1.43.x prior to 1.43.6, 1.44.x prior to 1.44.3 or 1.45.x prior to 1.45.1. It is, therefore, affected by a number of vulnerabilities as follows.

- The xslt option is enabled by default in API format=xml responses. (CVE-2025-67484)

- Failure to escape the word-separator message in Special:ApiSandbox. (CVE-2025-67477)

- Failure to escape square brackets in autocomment links. (CVE-2025-67475)

- The importer's IP is used in case of an external revision author, leading to information disclosure. (CVE-2025-67476)

- Failure to always escape commas in mail encoded-words. (CVE-2025-67478)

- The Sanitizer does not disallow underscore and wide underscore in data-* attribute names. (CVE-2025-67479)

- Missing read permission check in ApiQueryRevisionsBase enabling an access control bypass. (CVE-2025-67480)

- Failure to escape the 'comma-separator' between multiple protection levels. (CVE-2025-67483)

- The 'style' attribute is allowed in client-side messages (jqueryMsg), enabling XSS. (CVE-2025-67481)

- A Lua segfault in unpack() leading to a denial of service. (CVE-2025-67482)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4428 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4428-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     December 30, 2025                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : mediawiki     Version        : 1:1.35.13-1+deb11u6     CVE ID         : CVE-2025-67475 CVE-2025-67478 CVE-2025-67479 CVE-2025-67480                      CVE-2025-67481 CVE-2025-67482 CVE-2025-67484

    Multiple security vulnerabilities were found in mediawiki, a website     engine for collaborative work, which could lead to information     disclosure, denial of service or privilege escalation.

    CVE-2025-67475

        Square brackets in autocomment links were not always escaped.

    CVE-2025-67478

        Commas not separating values in RFC 2822 style headers were not         escaped, hence could be interpreted downstream as value separators.

    CVE-2025-67479

        Underscore and wide underscore were not always sanitized in `data-*`         attribute names.

    CVE-2025-67480

        ApiQueryRevisionsBase did not check for read permissions for the         target page.

    CVE-2025-67481

        Insufficient `style` attribute sanitation in client-side messages         (jqueryMsg).

        As such attributes are difficult to sanitize properly (the logic         needs to be updated constantly as new CSS features are developed by         browser vendors) and their use cases in client-side messages are         extremely rare, they are no longer allowed.

        If needed, `class` and `id` are still allowed, so these elements can         be targeted by normal stylesheets.

    CVE-2025-67482

        Scribunto extension: Segfault in unpack() with large integers         affecting some builds of Lua.

    CVE-2025-67484

        Cross-site scripting (XSS) vulnerability via xslt option for users         with the editinterface permission.  The xslt option is now         disabled by default.  If the former unsafe behavior is desired, is         can be re-enabled by setting `$wgEnableUnsafeXsltOption` to true.

    For Debian 11 bullseye, these problems have been fixed in version     1:1.35.13-1+deb11u6.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6085 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6085-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     December 19, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : mediawiki     CVE ID         : CVE-2025-11173 CVE-2025-11261 CVE-2025-61635 CVE-2025-61638                      CVE-2025-61639 CVE-2025-61640 CVE-2025-61641 CVE-2025-61643                      CVE-2025-61646 CVE-2025-61653 CVE-2025-61655 CVE-2025-61656                      CVE-2025-67475 CVE-2025-67478 CVE-2025-67479 CVE-2025-67480                      CVE-2025-67481 CVE-2025-67482 CVE-2025-67484 CVE-2025-67483                      CVE-2025-67477 CVE-2025-61657 CVE-2025-61654 CVE-2025-61652                      CVE-2025-61642 CVE-2025-61637 CVE-2025-61636 CVE-2025-61634                      CVE-2025-11175

    Multiple security issues were discovered in MediaWiki, a website engine for     collaborative work, which could result in cross-site scripting, information     disclosure, missing rate limiting or denial of service.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1:1.39.17-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 1:1.43.6+dfsg-1~deb13u1.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files     includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3,     1.45.1. (CVE-2025-67484)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
115331	MediaWiki 1.45.x < 1.45.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115330	MediaWiki 1.44.x < 1.44.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115329	MediaWiki 1.43.x < 1.43.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115328	MediaWiki < 1.39.16 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
280692	Debian dla-4428 : mediawiki - security update	Nessus	Debian Local Security Checks	medium
279440	Debian dsa-6085 : mediawiki - security update	Nessus	Debian Local Security Checks	high
278370	Linux Distros Unpatched Vulnerability : CVE-2025-67484	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-67484

info

Tenable Plugins

medium

medium

medium

medium

medium

high

critical