CVE-2025-61653: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-61653 is an information disclosure vulnerability in the Wikimedia Foundation's TextExtracts MediaWiki extension, specifically in includes/ApiQueryExtracts.php. The extension fails to check for authorizeRead permissions when returning page extracts via the API, allowing unauthorized users to access content from restricted pages. It affects all TextExtracts versions before 1.39.14, 1.43.4, and 1.44.1. The vulnerability was published on February 3, 2026, and carries a CVSS v4.0 base score of 2.7 (Low) (Red Hat CVE, EUVD).

The root cause is classified as CWE-22 (Path Traversal / Improper Limitation of a Pathname to a Restricted Directory), though the practical manifestation is an authorization bypass — the ApiQueryExtracts.php file does not invoke the authorizeRead check before returning page text extracts. An unauthenticated remote attacker can query the TextExtracts API endpoint to retrieve text content from pages that are otherwise access-restricted, requiring no privileges or user interaction. The vulnerability is tracked in the Wikimedia Phabricator task T397577 (Phabricator, Infinitsec).

Successful exploitation results in unauthorized disclosure of restricted MediaWiki page content, impacting confidentiality. An attacker can extract text from pages that are protected by read restrictions without authentication, potentially exposing sensitive wiki content such as internal documentation, draft articles, or access-controlled information. There is no integrity or availability impact, and lateral movement potential is limited to information gathering (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is approximately 0.052% (0.000520), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and exploit maturity is rated as "Unreported" (Red Hat CVE).

1. Reconnaissance: Identify a MediaWiki instance running the TextExtracts extension with version prior to 1.39.14, 1.43.4, or 1.44.1, and confirm the extension is enabled.
2. Identify restricted pages: Attempt to browse or enumerate wiki pages that return access-denied errors when accessed via the standard web interface, indicating read-restricted content.
3. Query the TextExtracts API: Send an unauthenticated HTTP GET request to the MediaWiki API endpoint using the extracts module, e.g., GET /api.php?action=query&prop=extracts&titles=<RestrictedPageTitle>&format=json.
4. Retrieve restricted content: Due to the missing authorizeRead check in ApiQueryExtracts.php, the API returns the text extract of the restricted page to the unauthenticated requester, bypassing the intended access control (Infinitsec, Phabricator).

• Network: Unusual or high-volume unauthenticated API requests to /api.php?action=query&prop=extracts targeting page titles that are normally access-restricted; requests originating from unexpected IP ranges.
• Logs: MediaWiki access logs showing repeated API queries with prop=extracts from unauthenticated sessions (no session cookie or logged-out users) for pages with restricted read permissions.
• Application: API responses returning content for pages that should be inaccessible to anonymous users, observable in server-side API response logging if enabled.

Update the TextExtracts MediaWiki extension to a patched version: 1.39.14, 1.43.4, or 1.44.1. Debian LTS users should apply the security update referenced in DLA-4355-1, and Debian stable users should apply DSA-6085-1. No configuration-based workaround is documented; upgrading is the recommended remediation (Debian LTS, Debian Security, Red Hat CVE).

The vulnerability received coverage from Linux security advisory aggregators and was included in Debian and Mageia security update announcements. A technical write-up was published by Infinitsec detailing the missing authorization check. No significant vendor statements beyond the patch release or notable social media discussion have been identified (Infinitsec, Debian LTS).