CVE-2025-61634 Overview
A vulnerability has been identified in Wikimedia Foundation MediaWiki affecting the REST API functionality. The issue is associated with the includes/Rest/Handler/PageHTMLHandler.php file, which handles HTML rendering requests for wiki pages through the REST API interface.
Critical Impact
This vulnerability affects MediaWiki installations across multiple versions and could potentially impact wiki page rendering through the REST API handler.
Affected Products
- MediaWiki versions before 1.39.14
- MediaWiki versions before 1.43.4
- MediaWiki versions before 1.44.1
Discovery Timeline
- 2026-02-03 - CVE CVE-2025-61634 published to NVD
- 2026-02-03 - Last updated in NVD database
Technical Details for CVE-2025-61634
Vulnerability Analysis
The vulnerability resides within the PageHTMLHandler.php file, which is part of MediaWiki's REST API infrastructure. This handler is responsible for processing requests that generate HTML output for wiki pages. The REST API in MediaWiki provides programmatic access to wiki content and functionality, making this component critical for applications and services that interact with MediaWiki installations.
The PageHTMLHandler class manages the transformation of wiki markup into rendered HTML, serving responses to clients requesting page content through RESTful endpoints. Given the network-accessible nature of this vulnerability, an attacker with network access to a vulnerable MediaWiki instance could potentially interact with this handler through crafted API requests.
Root Cause
The root cause of this vulnerability lies in the includes/Rest/Handler/PageHTMLHandler.php file. While specific technical details are limited in public disclosures, the vulnerability appears to be related to how the handler processes or validates incoming requests for HTML page content. Additional technical details can be found in the Wikimedia Task Discussion.
Attack Vector
This vulnerability has a network-based attack vector, meaning it can be exploited remotely by attackers who can reach the MediaWiki REST API endpoint. The attack requires some form of user interaction as a prerequisite condition, and certain preconditions must be present for successful exploitation.
The REST API endpoint typically accessible at /rest.php/v1/page/{title}/html would be the likely target for any exploitation attempts targeting this vulnerability.
Detection Methods for CVE-2025-61634
Indicators of Compromise
- Unusual or malformed requests to MediaWiki REST API endpoints, particularly those targeting /rest.php/v1/page/*/html paths
- Increased error rates or unexpected behavior in PageHTMLHandler.php related log entries
- Anomalous API access patterns from unknown or suspicious IP addresses
Detection Strategies
- Monitor web server access logs for unusual patterns of requests to REST API endpoints
- Implement application-level logging for MediaWiki REST API handler invocations
- Deploy web application firewall (WAF) rules to detect and block malformed REST API requests
Monitoring Recommendations
- Enable detailed logging for MediaWiki REST API components
- Set up alerts for unusual request volumes or error patterns in the REST API subsystem
- Monitor for any unexpected modifications to wiki pages or system configurations
How to Mitigate CVE-2025-61634
Immediate Actions Required
- Upgrade MediaWiki to version 1.39.14 or later for the 1.39.x branch
- Upgrade MediaWiki to version 1.43.4 or later for the 1.43.x branch
- Upgrade MediaWiki to version 1.44.1 or later for the 1.44.x branch
- Review REST API access logs for any suspicious activity prior to patching
Patch Information
Wikimedia Foundation has addressed this vulnerability in MediaWiki versions 1.39.14, 1.43.4, and 1.44.1. Organizations running affected versions should upgrade to the appropriate patched release as soon as possible. For detailed patch information and release notes, refer to the Wikimedia Task Discussion.
Workarounds
- If immediate patching is not possible, consider restricting access to the REST API endpoints at the web server or firewall level
- Implement rate limiting on REST API endpoints to reduce potential attack surface
- Consider temporarily disabling the REST API if it is not required for operations until the patch can be applied
# Example: Apache configuration to restrict REST API access
<Location "/rest.php">
Require ip 10.0.0.0/8
Require ip 192.168.0.0/16
</Location>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
