CVE-2025-67479: MediaWiki Core Parser Vulnerability

CVE-2025-67479 Overview

A vulnerability has been identified in Wikimedia Foundation MediaWiki and the Cite extension. This security issue is associated with program files includes/Parser/CoreParserFunctions.php and includes/Parser/Sanitizer.php, which are core components of MediaWiki's parsing infrastructure.

The vulnerability affects MediaWiki versions before 1.39.14, 1.43.4, and 1.44.1, as well as the Cite extension across the same version ranges.

Critical Impact

While this vulnerability has a network-based attack vector, the current assessment indicates no direct confidentiality, integrity, or availability impact. Organizations running affected MediaWiki installations should still review and apply available patches as a precautionary measure.

Affected Products

• MediaWiki versions before 1.39.14
• MediaWiki versions before 1.43.4
• MediaWiki versions before 1.44.1
• Cite extension versions before 1.39.14, 1.43.4, and 1.44.1

Discovery Timeline

• 2026-02-03 - CVE-2025-67479 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-67479

Vulnerability Analysis

This vulnerability resides within MediaWiki's parser subsystem, specifically affecting two critical files: CoreParserFunctions.php and Sanitizer.php. These components are responsible for processing and sanitizing wiki markup content before rendering.

The parser functions in MediaWiki handle various text transformations, template expansions, and content sanitization operations. When vulnerabilities exist in these core parsing components, they can potentially affect how user-supplied content is processed across the entire wiki platform.

The Cite extension, which provides citation and reference functionality for MediaWiki installations, is also affected by this issue. This extension integrates closely with the core parser functionality, sharing the vulnerability footprint.

Root Cause

The vulnerability originates in the MediaWiki parser subsystem, specifically within the CoreParserFunctions.php and Sanitizer.php files. These files handle critical parsing and sanitization operations for wiki content. The exact technical root cause involves improper handling within these parsing components, as documented in the Wikimedia Task T407131.

Attack Vector

The vulnerability is exploitable over the network. While the attack requires specific conditions to be met (high complexity with prerequisites), it can be attempted without authentication. The exploitation does not require user interaction, making it potentially automatable under the right circumstances.

Due to the nature of this vulnerability affecting parser components, potential attack scenarios would involve crafted input being processed by the MediaWiki parser infrastructure. For detailed technical information about the attack methodology, refer to the Wikimedia security advisory.

Detection Methods for CVE-2025-67479

Indicators of Compromise

• Monitor web server logs for unusual requests targeting MediaWiki parser functionality
• Review error logs for parsing-related exceptions or anomalies in CoreParserFunctions.php or Sanitizer.php
• Check for unexpected content rendering behavior in wiki pages

Detection Strategies

• Implement web application firewall rules to detect malformed parser input patterns
• Enable verbose logging for MediaWiki parser operations to identify anomalous behavior
• Deploy file integrity monitoring on affected MediaWiki core files

Monitoring Recommendations

• Configure alerting for unusual parser error rates or exceptions
• Monitor MediaWiki performance metrics for unexpected resource consumption during parsing operations
• Review access logs for patterns indicative of vulnerability scanning or exploitation attempts

How to Mitigate CVE-2025-67479

Immediate Actions Required

• Update MediaWiki to version 1.39.14, 1.43.4, or 1.44.1 depending on your current release branch
• Update the Cite extension to the corresponding patched version
• Review MediaWiki configuration for any custom parser extensions that may interact with affected components
• Implement network-level controls to restrict access to MediaWiki installations where possible

Patch Information

Wikimedia Foundation has released patched versions addressing this vulnerability. Organizations should upgrade to MediaWiki 1.39.14, 1.43.4, or 1.44.1 based on their current deployment branch. The Cite extension should also be updated to the matching version.

For detailed patch information and technical discussion, refer to the Wikimedia Phabricator task T407131.

Workarounds

• Restrict network access to MediaWiki installations using firewall rules or reverse proxy configurations
• Implement rate limiting on requests to reduce potential exploitation attempts
• Consider temporarily disabling the Cite extension if citation functionality is not critical
• Enable additional input validation at the web application firewall level

# Example: Restrict MediaWiki access via Apache configuration
# Add to your MediaWiki virtual host configuration
<Location "/wiki">
    Order deny,allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Location>