CVE-2025-67476: MediaWiki Import Vulnerability

CVE-2025-67476 Overview

A vulnerability has been identified in Wikimedia Foundation MediaWiki affecting the includes/Import/ImportableOldRevisionImporter.php file. This vulnerability allows authenticated users to potentially access limited confidential information through the wiki import functionality. While the severity is low, organizations running affected MediaWiki installations should apply updates to maintain proper security boundaries.

Critical Impact

Authenticated users may be able to access limited confidential information through the import functionality in affected MediaWiki versions.

Affected Products

• MediaWiki versions before 1.44.3
• MediaWiki versions before 1.45.1

Discovery Timeline

• 2026-02-03 - CVE CVE-2025-67476 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-67476

Vulnerability Analysis

This vulnerability exists within the ImportableOldRevisionImporter.php file in MediaWiki's import subsystem. The import functionality is designed to allow administrators and privileged users to import content from XML dump files, typically used for migrating content between wiki installations or restoring backups.

The flaw allows an authenticated user with import privileges to potentially access limited confidential information that should otherwise be restricted. The vulnerability requires network access and valid authentication credentials, but does not require any user interaction to exploit. The impact is limited to confidentiality with no effect on integrity or availability of the system.

Root Cause

The root cause appears to be an information exposure issue within the old revision import handling logic. The ImportableOldRevisionImporter.php component does not properly restrict access to certain data during the import process, allowing authenticated users to view information beyond their intended authorization scope.

Attack Vector

The attack is network-based and requires the attacker to have valid authentication credentials with import privileges on the target MediaWiki installation. The attacker would leverage the import functionality to access limited confidential information. The low complexity of the attack means no special conditions or circumstances need to be met beyond having authenticated access to the system.

The vulnerability affects the import workflow where XML content is processed for migration or restoration purposes. An attacker with appropriate privileges could potentially craft or manipulate import requests to expose information not intended for their access level.

Detection Methods for CVE-2025-67476

Indicators of Compromise

• Unusual activity in MediaWiki import logs from authenticated users
• Unexpected access patterns to the ImportableOldRevisionImporter.php component
• Anomalous import operations that do not align with normal administrative workflows

Detection Strategies

• Monitor MediaWiki access logs for unusual import activity patterns
• Review audit logs for authenticated users accessing import functionality outside normal maintenance windows
• Implement file integrity monitoring on MediaWiki core files, particularly in the includes/Import/ directory

Monitoring Recommendations

• Enable verbose logging for MediaWiki import operations
• Configure alerting for import activities from non-administrative user accounts
• Regularly review access control lists for users with import privileges

How to Mitigate CVE-2025-67476

Immediate Actions Required

• Upgrade MediaWiki to version 1.44.3 or later for the 1.44.x branch
• Upgrade MediaWiki to version 1.45.1 or later for the 1.45.x branch
• Review and restrict import privileges to only essential administrative accounts
• Audit recent import activity logs for any suspicious access patterns

Patch Information

Wikimedia Foundation has addressed this vulnerability in MediaWiki versions 1.44.3 and 1.45.1. Organizations should update to these versions or later to remediate the vulnerability. For detailed technical information about the fix, refer to the Wikimedia Task T405859.

Workarounds

• Temporarily disable or restrict access to the Special:Import page until patches can be applied
• Review and remove import privileges from non-essential user accounts
• Implement additional access controls at the web server level to restrict access to import functionality
• Consider placing MediaWiki behind a reverse proxy with additional authentication for administrative functions

# Restrict import functionality in LocalSettings.php
$wgGroupPermissions['*']['import'] = false;
$wgGroupPermissions['user']['import'] = false;
$wgGroupPermissions['sysop']['import'] = true;
# Only trusted administrators should have import privileges