CVE-2025-61654: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-61654 is a path traversal vulnerability (CWE-22) in the Wikimedia Foundation Thanks MediaWiki extension, associated with the file includes/ThanksQueryHelper.php. It affects Thanks versions from any release before 1.43.4 and before 1.44.1. The vulnerability was published on February 3, 2026, and is tracked by both NVD and the EU Vulnerability Database. The CVSS v4.0 base score is 0.0 (None) as scored by the CNA, though Feedly estimates the severity as HIGH based on the CWE classification (Red Hat CVE, EUVD).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'), meaning the affected code in includes/ThanksQueryHelper.php fails to properly sanitize or restrict file path inputs, potentially allowing an attacker to traverse outside intended directories. The attack vector is network-based, requires low privileges (authenticated user), no user interaction, and low attack complexity, suggesting that any logged-in MediaWiki user could trigger the flaw. The associated CAPEC patterns include CAPEC-126 (Path Traversal), CAPEC-64 (Using Slashes and URL Encoding to Bypass Validation), and CAPEC-76 (Manipulating Web Input to File System Calls), indicating the likely exploitation mechanism involves crafted path strings or encoded slashes (Red Hat CVE, Wikimedia Phabricator).

Exploitation of this vulnerability by an authenticated attacker could allow unauthorized access to files or data outside the intended directory scope within a MediaWiki installation running the Thanks extension. Given the path traversal nature and the low-privilege requirement, the practical impact may include unauthorized reading of sensitive configuration files or data accessible to the web server process. The CNA's CVSS v4.0 score reflects no direct confidentiality, integrity, or availability impact in the base metrics, suggesting the exploitability may be constrained by the MediaWiki environment's file access controls (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-61654. The EPSS score is approximately 0.052% (0.000520), indicating a very low probability of exploitation in the near term. The exploit maturity is listed as "Unreported" and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE, Feedly).

Users should upgrade the MediaWiki Thanks extension to version 1.43.4 or 1.44.1 or later, as these versions contain the fix for CVE-2025-61654. No specific configuration-based workarounds have been publicly documented; disabling the Thanks extension entirely would eliminate exposure if upgrading is not immediately possible. Administrators running MediaWiki instances should also review the Wikimedia Phabricator task for additional context and patch details (Wikimedia Phabricator, Debian Security).

The vulnerability was included in a Debian Security Advisory (DSA-6085-1) covering MediaWiki, indicating it was considered significant enough for downstream Linux distribution patching (Debian Security, Linux Security). Tenable published detection plugins for this CVE (Nessus plugin 279440), and it was noted in a CISA vulnerability summary for the week of February 2, 2026. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage.