CVE-2025-61653: Wikimedia TextExtracts Vulnerability

CVE-2025-61653 Overview

A vulnerability has been identified in Wikimedia Foundation TextExtracts, specifically associated with the program file includes/ApiQueryExtracts.php. This vulnerability affects TextExtracts versions prior to 1.39.14, 1.43.4, and 1.44.1. The issue involves a network-accessible attack vector that could potentially lead to limited confidentiality impact.

Critical Impact

This low-severity vulnerability in Wikimedia's TextExtracts extension may allow unauthorized network-based access to limited information through the API query extracts functionality.

Affected Products

• Wikimedia Foundation TextExtracts versions before 1.39.14
• Wikimedia Foundation TextExtracts versions before 1.43.4
• Wikimedia Foundation TextExtracts versions before 1.44.1

Discovery Timeline

• 2026-02-03 - CVE CVE-2025-61653 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-61653

Vulnerability Analysis

The vulnerability resides in the ApiQueryExtracts.php file within the TextExtracts extension for MediaWiki. This extension is responsible for providing API functionality that extracts portions of page content for display purposes, commonly used for generating page previews and summaries.

The flaw allows for potential information exposure through the network without requiring authentication or user interaction. While the impact is limited to confidentiality concerns with no integrity or availability implications, organizations running vulnerable versions should address this issue as part of their security maintenance practices.

Root Cause

The vulnerability originates from improper handling within the includes/ApiQueryExtracts.php component. The specific technical details regarding the root cause can be found in the Wikimedia Task T397577 tracking this issue. The flaw allows network-based attackers to potentially access limited confidential information without requiring privileges or user interaction.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity. An attacker does not require any privileges or user interaction to exploit this flaw. The attack can be executed remotely against affected TextExtracts installations.

The vulnerability manifests in the API query extracts functionality. For detailed technical information about the exploitation mechanism, refer to the Wikimedia security advisory.

Detection Methods for CVE-2025-61653

Indicators of Compromise

• Unusual API requests targeting the TextExtracts functionality, particularly calls to endpoints associated with ApiQueryExtracts.php
• Anomalous query patterns or parameter manipulation in extract-related API calls
• Unexpected data exposure in API responses from the TextExtracts extension

Detection Strategies

• Monitor web server logs for suspicious requests to MediaWiki API endpoints related to text extraction functionality
• Implement application-layer monitoring for unusual patterns in API query parameters
• Review access logs for high-volume or scripted requests targeting extract-related endpoints

Monitoring Recommendations

• Enable detailed logging for MediaWiki API requests, particularly those involving the TextExtracts extension
• Configure alerting for anomalous traffic patterns targeting the affected component
• Regularly audit API access logs for signs of reconnaissance or exploitation attempts

How to Mitigate CVE-2025-61653

Immediate Actions Required

• Upgrade TextExtracts to version 1.39.14, 1.43.4, or 1.44.1 depending on your MediaWiki branch
• Review API access controls and ensure appropriate restrictions are in place
• Audit recent API logs for any suspicious activity targeting the TextExtracts functionality

Patch Information

Wikimedia Foundation has released patched versions addressing this vulnerability. Organizations should upgrade to TextExtracts version 1.39.14 or later for the 1.39.x branch, version 1.43.4 or later for the 1.43.x branch, or version 1.44.1 or later for the 1.44.x branch. Detailed information about the fix is available in the Wikimedia Task T397577.

Workarounds

• Restrict access to the MediaWiki API through network-level controls if upgrading is not immediately possible
• Implement rate limiting on API endpoints to reduce potential exposure
• Consider temporarily disabling the TextExtracts extension if it is not critical to operations until patching can be completed

# Example: Disable TextExtracts extension temporarily in LocalSettings.php
# Comment out or remove the following line until patch is applied:
# wfLoadExtension( 'TextExtracts' );