CVE-2025-6591: MediaWiki ApiFeedContributions Vulnerability

CVE-2025-6591 Overview

CVE-2025-6591 is a vulnerability affecting Wikimedia Foundation MediaWiki, specifically associated with the program file includes/api/ApiFeedContributions.php. This issue impacts MediaWiki versions before 1.39.13, as well as versions 1.42.7, 1.43.2, and 1.44.0.

Critical Impact

While this vulnerability has been assigned a CVSS 4.0 score of 0 (None severity), organizations running affected MediaWiki versions should evaluate the issue in the context of their deployment and apply patches as a proactive security measure.

Affected Products

• MediaWiki versions before 1.39.13
• MediaWiki version 1.42.7
• MediaWiki versions 1.43.2 and 1.44.0

Discovery Timeline

• 2026-02-02 - CVE-2025-6591 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-6591

Vulnerability Analysis

This vulnerability resides within the ApiFeedContributions.php file in MediaWiki's API subsystem. The ApiFeedContributions module is responsible for generating RSS and Atom feeds of user contributions. Based on the available information and the CVSS 4.0 vector indicating a network-accessible vulnerability requiring high privileges and active user interaction, this appears to be a low-impact issue that does not directly result in confidentiality, integrity, or availability impacts in its current assessment.

The vulnerability requires an attacker to have high-level privileges within the MediaWiki system, and exploitation depends on active user interaction, significantly limiting the practical attack surface.

Root Cause

The root cause appears to be related to improper handling within the ApiFeedContributions.php component. While specific technical details are limited in the public disclosure, the vulnerability is associated with how the API module processes or generates feed contributions data. Organizations should review the Wikimedia Task Report for complete technical details.

Attack Vector

The vulnerability is exploitable over the network, but the attack complexity is low only when specific conditions are met. The attacker must possess high-level privileges within the MediaWiki instance, and successful exploitation requires active user interaction. These prerequisites significantly reduce the likelihood of exploitation in real-world scenarios.

Given that this vulnerability does not result in direct confidentiality, integrity, or availability impacts based on the CVSS assessment, the practical risk to most MediaWiki deployments is minimal. However, defense-in-depth principles recommend applying available patches regardless of perceived impact.

Detection Methods for CVE-2025-6591

Indicators of Compromise

• Unusual API requests targeting /api.php with action=feedcontributions parameters from privileged accounts
• Anomalous feed generation activity or unexpected patterns in contribution feed requests
• Log entries showing repeated access attempts to ApiFeedContributions endpoints

Detection Strategies

• Monitor MediaWiki API logs for suspicious patterns involving the feedcontributions action
• Implement alerting for privileged user accounts making unusual API requests
• Review web application firewall logs for anomalous requests to MediaWiki API endpoints

Monitoring Recommendations

• Enable detailed logging for MediaWiki API requests, particularly feed-related actions
• Establish baseline behavior for contribution feed usage and alert on deviations
• Correlate API access logs with user authentication events to identify potential misuse

How to Mitigate CVE-2025-6591

Immediate Actions Required

• Upgrade MediaWiki to version 1.39.13 or later for the 1.39.x branch
• Apply the latest security patches for MediaWiki versions 1.42.x, 1.43.x, and 1.44.x
• Review privileged user accounts and ensure principle of least privilege is enforced
• Monitor the Wikimedia Task Report for additional guidance

Patch Information

Organizations should upgrade to patched versions of MediaWiki as indicated in the vulnerability disclosure. The issue affects MediaWiki versions before 1.39.13 and specific versions in the 1.42.x, 1.43.x, and 1.44.x release branches. Consult the official MediaWiki security advisories and the Wikimedia Phabricator task for detailed patch information and upgrade instructions.

Workarounds

• Restrict access to the MediaWiki API for untrusted users until patches can be applied
• Implement web application firewall rules to monitor and limit API feed contribution requests
• Consider temporarily disabling the feed contributions feature if not required for operations

# Example: Restrict API access in LocalSettings.php
# Add these lines to limit API access to authenticated users only
$wgGroupPermissions['*']['read'] = true;
$wgGroupPermissions['*']['writeapi'] = false;
$wgGroupPermissions['user']['writeapi'] = true;