CVE Intelligence
Analysis AI-assisted

CVE-2025-67484: MediaWiki ApiFormatXml improper input validation flaw

CVE-2025-67484 is an improper input validation issue in Wikimedia MediaWiki, associated with the includes/Api/ApiFormatXml.Php file. NVD scores it 9.8 (critical) under CVSS 3.1 and the description lists fixed releases 1.39.16, 1.43.6, 1.44.3 and 1.45.1. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-67484 affects Wikimedia Foundation MediaWiki and is associated with the program file includes/Api/ApiFormatXml.Php. The record classifies the weakness as CWE-20, Improper Input Validation, and NVD assigns a CVSS 3.1 base score of 9.8 (critical).

Impact

  • NVD's vector describes a network-reachable attack with low complexity, no privileges required and no user interaction, with high impact on confidentiality, integrity and availability.
  • The record does not describe the concrete consequence of the flaw beyond the weakness class and the scoring. Any specific outcome should be treated as unknown until the vendor ticket is reviewed.

Affected products and versions

  • Product: MediaWiki (listed as Mediawiki Mediawiki).
  • Ranges in the structured record: 1.39.0 up to but not including 1.39.16; 1.43.0 up to but not including 1.43.6; 1.44.0 up to but not including 1.44.3; and version 1.45.0.
  • The description text states that versions before 1.39.16, 1.43.6, 1.44.3 and 1.45.1 are affected. The structured list does not show 1.45.1 as a boundary, so the two sources differ and should be checked against the vendor.

Exploitation status

  • The record shows no CISA KEV listing, and no EPSS data is available.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade MediaWiki to the release line that corresponds to your installation: 1.39.16, 1.43.6, 1.44.3 or 1.45.1, as stated in the description.
  • The structured fixes field is empty. Use the vendor's Phabricator ticket to confirm the fixed releases before scheduling changes.
  • Until patching is complete, limit access to the wiki's API endpoints where operationally possible, for example to trusted networks or authenticated users.

Detection guidance

  • Inventory all MediaWiki instances and record their exact versions, including extensions that may change API behaviour.
  • Review web server and application logs for unusual volumes or malformed requests to API endpoints that request XML output.
  • Compare detection results against the vendor's guidance once it is confirmed.

Limitations of the available information

  • The record has no title, so the title in this analysis was written from the description.
  • The only reference is the Wikimedia Phabricator ticket, tagged Permissions Required, and its content was not available for this analysis.
  • The CNA-provided CVSS 4.0 entry shows a score of 0, which is unclear and was not used for assessment.
  • No technical details of the flaw's trigger are provided, and none are included here.

Frequently asked questions

What is CVE-2025-67484?

It is an improper input validation weakness (CWE-20) in Wikimedia MediaWiki, associated with includes/Api/ApiFormatXml.Php. NVD scores it 9.8 under CVSS 3.1.

Which MediaWiki versions are fixed?

The description names 1.39.16, 1.43.6, 1.44.3 and 1.45.1 as the releases before which versions are affected. The structured fixes field is empty, so confirm with the vendor's Phabricator ticket.

Is this vulnerability being exploited?

It is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.