Sensitive Information Exposure in MediaWiki HTMLUserTextField Component

Publication date: 2026-02-02

Last updated on: 2026-02-02

Assigner: wikimedia-foundation

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php. This issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1, 1.44.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-02

Last Modified

2026-02-02

Generated

2026-07-06

AI Q&A

2026-02-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-6590

Affected Vendors & Products

Vendor	Product	Version / Range
wikimedia	mediawiki	to 1.39.12 (inc)
wikimedia	mediawiki	1.42.76
wikimedia	mediawiki	1.43.1
wikimedia	mediawiki	1.44.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Wikimedia Foundation MediaWiki involves the exposure of sensitive information to unauthorized actors. It is related to the program file includes/htmlform/fields/HTMLUserTextField.Php and affects multiple versions of MediaWiki up to 1.44.0.

Impact Analysis

The vulnerability can lead to unauthorized access to sensitive information, potentially compromising data confidentiality and privacy for users of affected MediaWiki versions.

Hi! I’m here to help you understand CVE-2025-6590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70