Improper Input Validation in MediaWiki User.php Enables Exploits

Publication date: 2026-02-02

Last updated on: 2026-02-04

Assigner: wikimedia-foundation

Description

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-02

Last Modified

2026-02-04

Generated

2026-07-06

AI Q&A

2026-02-03

EPSS Evaluated

2026-07-04

NVD

CVE-2025-6593

Affected Vendors & Products

Vendor	Product	Version / Range
wikimedia	mediawiki	From 1.27.0 (inc) to 1.39.13 (exc)
wikimedia	mediawiki	1.42.7
wikimedia	mediawiki	1.43.2
wikimedia	mediawiki	1.44.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Wikimedia Foundation's MediaWiki software, specifically in the program file includes/user/User.Php. It affects multiple versions of MediaWiki from 1.27.0 before 1.39.13, 1.42.7 to 1.43.2, and 1.44.0. The CVSS v4.0 base score is 2.1, indicating a low severity issue that requires user interaction and has a low impact on confidentiality and security controls.

Impact Analysis

The vulnerability has a low severity score (2.1) and requires user interaction to be exploited. It has a low impact on confidentiality and security controls, suggesting that the potential impact on a system or user is limited. However, specific impacts are not detailed in the provided information.

Hi! I’m here to help you understand CVE-2025-6593. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70