CVE-2025-61634: 
NixOS vulnerability analysis and mitigation

CVE-2025-61634 is a vulnerability in Wikimedia Foundation MediaWiki affecting the includes/Rest/Handler/PageHTMLHandler.php file, related to improper page handling. It affects MediaWiki versions before 1.39.14, before 1.43.4, and versions 1.43.5 through before 1.44.1. The vulnerability was first inserted into Feedly's tracking in October 2025 and formally published on February 3, 2026. It carries a CVSS v3.1 base score of 3.1 (Low), requiring network access, high attack complexity, no privileges, and user interaction (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified under CWE-911 (Improper Update of Reference Count) and CWE-22 (Path Traversal), and is associated with CAPEC patterns including Path Traversal (CAPEC-126) and URL encoding bypass techniques (CAPEC-64, CAPEC-78, CAPEC-79). The flaw resides in includes/Rest/Handler/PageHTMLHandler.php, which handles the REST API endpoint for retrieving page HTML content in MediaWiki. Exploitation requires user interaction and specific attack conditions (high complexity), suggesting the vulnerability may be triggered when a user accesses a specially crafted page or URL that causes improper reference count handling or path traversal within the page handler (Red Hat Advisory, Red Hat Bugzilla). A technical write-up referencing the HTML REST endpoint and PoolCounter/parser cache checks has been noted (infinitsec.net).

The confirmed impact of this vulnerability is limited: the CVSS v3.1 assessment indicates only low confidentiality impact with no integrity or availability impact. The CVSS v4.0 assessment rates the vulnerability at 0.0 with no direct impact on confidentiality, integrity, or availability of the system. While remote attackers could potentially exploit this flaw over the network when users interact with affected MediaWiki instances, the practical risk of data exposure or system compromise appears minimal based on current analysis (Red Hat Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.052%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

Users should upgrade MediaWiki to one of the following patched versions: 1.39.14, 1.43.4, or 1.44.1. A patch is available and tracked via Red Hat Bugzilla. As a general precaution, administrators should review access controls on MediaWiki REST API endpoints and consider restricting network access to MediaWiki installations where feasible. Monitoring for unusual access patterns to the /rest.php/v1/page/*/html endpoint may help detect exploitation attempts (Red Hat Bugzilla, Red Hat Advisory). A Debian security advisory (DSA-6085-1) has also been issued covering this and related MediaWiki vulnerabilities (Debian Advisory).

The vulnerability received coverage in Debian's security announcement mailing list (DSA-6085-1) and was detected by Nessus plugin 279440. A blog post by a MediaWiki developer (bawolff.net) discussed XSS protector performance in the same timeframe, though not exclusively focused on this CVE. Community reaction has been minimal given the low severity score and absence of active exploitation (Debian Advisory).