CVE-2025-6593
Improper Input Validation in MediaWiki User.php Enables Exploits
Publication date: 2026-02-02
Last updated on: 2026-02-04
Assigner: wikimedia-foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wikimedia | mediawiki | From 1.27.0 (inc) to 1.39.13 (exc) |
| wikimedia | mediawiki | 1.42.7 |
| wikimedia | mediawiki | 1.43.2 |
| wikimedia | mediawiki | 1.44.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Wikimedia Foundation's MediaWiki software, specifically in the program file includes/user/User.Php. It affects multiple versions of MediaWiki from 1.27.0 before 1.39.13, 1.42.7 to 1.43.2, and 1.44.0. The CVSS v4.0 base score is 2.1, indicating a low severity issue that requires user interaction and has a low impact on confidentiality and security controls.
How can this vulnerability impact me? :
The vulnerability has a low severity score (2.1) and requires user interaction to be exploited. It has a low impact on confidentiality and security controls, suggesting that the potential impact on a system or user is limited. However, specific impacts are not detailed in the provided information.