Information Disclosure Vulnerability in MediaWiki BlockListPager Component

Publication date: 2026-02-02

Last updated on: 2026-03-03

Assigner: wikimedia-foundation

Description

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php. This issue affects MediaWiki: >= 1.42.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-02

Last Modified

2026-03-03

Generated

2026-07-06

AI Q&A

2026-02-03

EPSS Evaluated

2026-07-04

NVD

CVE-2025-6589

Affected Vendors & Products

Vendor	Product	Version / Range
wikimedia	mediawiki	From 1.42.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Compliance Impact

There is no information provided about how this vulnerability affects compliance with standards such as GDPR or HIPAA.

Executive Summary

This vulnerability exists in the Wikimedia Foundation's MediaWiki software, specifically in the program file includes/specials/pagers/BlockListPager.Php. It affects MediaWiki versions 1.42.0 and later. The exact nature of the vulnerability is not detailed in the provided information.

Impact Analysis

The impact details of this vulnerability are not specified in the provided information. Given the low CVSS base score of 2.1, it may have limited impact, but exact consequences are unknown.

Hi! I’m here to help you understand CVE-2025-6589. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70