Debian 11: MediaWiki Critical Info Disclosure & DoS Threat DLA-4355-1
debian lts
October 31, 2025
Multiple security vulnerabilities were found in mediawiki, a website engine for collaborative work, that could lead to information disclosure, denial of service or privilege escala...
Summary
CVE-2025-11173
OATHAuth extension: Reauthentication for enabling 2FA can be
bypassed by submitting a form in Special:OATHManage.
CVE-2025-11261
Stored i18n Cross-site scripting (XSS) vulnerability in
mw.language.listToText.
CVE-2025-61635
ConfirmEdit extension: Missing rate limiting in
ApiFancyCaptchaReload.
CVE-2025-61638
Parsoid: Validation bypass for `data-` attributes.
CVE-2025-61639
Log entries which are hidden from the creation of the entry may be
disclosed to the public recent change entry.
CVE-2025-61640
Stored i18n Cross-site scripting (XSS) vulnerability in
Special:RecentChangesLinked.
CVE-2025-61641
DDoS vulnerability in QueryAllPages API in miser mode. The
`maxsize` value is now ignored in that mode.
CVE-2025-61643
Suppressed recent changes may be disclosed to the public RCFeeds.
CVE-2025-61646
Public Watchlist/RecentChanges pages may disclose hidden usernames
when an individual editor makes consecutive revisions on a single
PREVIOUS
NEXT
Severity
critical
Lowest
Low
Medium
High
Critical
Package: mediawiki
Version: 1:1.35.13-1+deb11u5
CVE ID: CVE-2025-11173 CVE-2025-11261 CVE-2025-61635 CVE-2025-61638
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!