CVE-2025-61641 Overview
A vulnerability has been identified in Wikimedia Foundation MediaWiki affecting the API query functionality. This security issue is associated with the program file includes/api/ApiQueryAllPages.php, which handles page enumeration requests through the MediaWiki API.
Critical Impact
This vulnerability affects MediaWiki installations and could potentially impact availability of wiki services through the AllPages API endpoint.
Affected Products
- MediaWiki versions before 1.39.14
- MediaWiki versions before 1.43.4
- MediaWiki versions before 1.44.1
Discovery Timeline
- 2026-02-03 - CVE CVE-2025-61641 published to NVD
- 2026-02-03 - Last updated in NVD database
Technical Details for CVE-2025-61641
Vulnerability Analysis
The vulnerability resides in the ApiQueryAllPages.php file, which is part of MediaWiki's API subsystem responsible for handling requests to enumerate all pages in a wiki. This API module allows users to list pages matching certain criteria, and the vulnerability appears to be related to how these requests are processed.
The affected component handles API queries that can list all pages within a MediaWiki installation. Without proper safeguards, this functionality could potentially be abused to cause resource consumption issues on the server, leading to limited availability impacts.
Root Cause
The root cause appears to be related to improper handling within the ApiQueryAllPages.php module. While specific technical details are limited in the public disclosure, the vulnerability affects how the API processes page enumeration requests, potentially allowing for resource exhaustion scenarios under specific conditions.
Attack Vector
The vulnerability is exploitable over the network without requiring authentication. However, exploitation requires certain preconditions to be met (AT:P in CVSS 4.0), suggesting that successful exploitation depends on specific environmental factors or configuration states.
An attacker could potentially craft malicious API requests targeting the AllPages endpoint to trigger the vulnerable condition. The impact is limited to availability (VA:L), indicating that successful exploitation would result in limited denial of service rather than data compromise.
For detailed technical information about this vulnerability, refer to the Wikimedia Task T298690.
Detection Methods for CVE-2025-61641
Indicators of Compromise
- Unusual volume of API requests targeting the api.php endpoint with list=allpages parameters
- Increased server resource utilization during API query processing
- Repeated requests to the AllPages API from single sources in short time periods
Detection Strategies
- Monitor MediaWiki API access logs for anomalous patterns in allpages queries
- Implement rate limiting detection for API endpoints to identify potential abuse
- Review server performance metrics for correlation with API request spikes
Monitoring Recommendations
- Enable detailed logging for MediaWiki API requests
- Configure alerting for unusual resource consumption patterns on MediaWiki servers
- Monitor for repeated failed or slow API responses from the AllPages module
How to Mitigate CVE-2025-61641
Immediate Actions Required
- Upgrade MediaWiki to version 1.39.14, 1.43.4, or 1.44.1 or later depending on your release branch
- Review API access controls and consider restricting anonymous API access if not required
- Implement rate limiting on API endpoints to reduce potential impact
Patch Information
Wikimedia Foundation has addressed this vulnerability in MediaWiki versions 1.39.14, 1.43.4, and 1.44.1. Organizations running affected versions should upgrade to the appropriate patched release for their deployment branch.
For more information about the fix, consult the Wikimedia Phabricator Task T298690.
Workarounds
- Implement web application firewall (WAF) rules to rate limit requests to the MediaWiki API
- Restrict API access to authenticated users only if anonymous API access is not required
- Consider disabling or limiting the AllPages API module if not needed for your wiki's functionality
# Example: Restrict API rate limiting in LocalSettings.php
# Add rate limiting configuration
$wgRateLimits['query']['ip'] = [ 30, 60 ]; # 30 requests per 60 seconds per IP
$wgRateLimits['query']['newbie'] = [ 20, 60 ]; # 20 requests per 60 seconds for new users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
