CVE-2025-67479: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-67479 is an improperly controlled modification of dynamically-determined object attributes vulnerability (CWE-915) affecting Wikimedia Foundation MediaWiki and its Cite extension. The vulnerability is associated with the parser and sanitizer components in includes/Parser/CoreParserFunctions.php and includes/Parser/Sanitizer.php. It affects MediaWiki and the Cite extension in all versions before 1.39.14, 1.43.4, and 1.44.1. The vulnerability was published on February 3, 2026, and carries a CVSS v4.0 base score of 0.0 (None) per the official vector, though Feedly estimates the severity as HIGH (Red Hat Bugzilla, Red Hat CVE).

The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), located in MediaWiki's parser and sanitizer subsystems — specifically includes/Parser/CoreParserFunctions.php and includes/Parser/Sanitizer.php. An attacker can craft malicious wiki markup or parser input that bypasses normal sanitization controls, potentially manipulating object attributes in unexpected ways during page rendering. The attack vector is network-based with high attack complexity and requires specific attack conditions to be present (AT:P), and no privileges or user interaction are required. No public proof-of-concept or detailed technical write-up has been disclosed at this time (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation could allow attackers to manipulate object attributes within MediaWiki's parser and sanitizer in unintended ways, potentially leading to application behavior manipulation, content integrity issues, or bypass of sanitization controls. Given the involvement of core parser functions, maliciously crafted input could affect how wiki content is processed and rendered, potentially impacting system integrity. Confidentiality, integrity, and availability impacts are all rated as None in the official CVSS v4.0 scoring, though the practical risk to content handling and sanitization logic may be higher in certain deployment contexts (Red Hat CVE).

There is no evidence of public proof-of-concept code or active in-the-wild exploitation at this time. The EPSS score is approximately 0.063%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The exploit maturity is rated as "Unreported" in the CVSS v4.0 vector (Red Hat CVE).

Users should upgrade MediaWiki and the Cite extension to one of the patched versions: 1.39.14, 1.43.4, or 1.44.1. For installations that cannot be immediately patched, administrators should implement network-level controls to restrict access to MediaWiki instances and monitor for suspicious activity related to parser or content handling. Reviewing and restricting wiki editing permissions to trusted users may also reduce exposure while updates are being prepared (Red Hat Bugzilla, Red Hat CVE).

Debian issued a security advisory (DSA-6085-1) and a Debian LTS announcement (DLA-4428-1) covering MediaWiki updates that include fixes for this CVE, indicating downstream Linux distributions have prioritized patching (Debian Security Announce, Debian LTS Announce). Tenable published Nessus detection plugins (IDs 278539 and 279440) for this vulnerability. No significant researcher commentary or social media discussion has been observed beyond routine vulnerability tracking.