CVE-2025-54865 is a high severity SQL injection in Tilesheets, a MediaWiki extension that adds a table lookup parser function for item images. A missing backtick in a database query lets input reach the SQL statement. The NVD record says it has not been fixed, so read the advisory for current status.
What's affected
- Product: the Tilesheets extension for MediaWiki, from the FTB-Gamepedia project.
- Location: a query in the Special:SheetManager code, in
special/SheetManager.php. - Fixed versions: unclear. The NVD description says the issue has not been fixed, while the GitHub advisory lists a patched version field of "> 5.0.3". Those two statements do not agree, so check the advisory and the repository yourself before relying on either.
The advisory's own impact note is measured. It says it is likely not possible to get a working query through the quote problem alone because the column name will always be unknown, but that some server configurations might allow a bypass. That is why the project still treats it as a vulnerability rather than a curiosity.
How to check if you're exposed
If you run a MediaWiki site, list the extensions you have enabled and their versions.
grep -n "Tilesheets" LocalSettings.php
git -C extensions/Tilesheets log -1 --format="%H %cd"
The first command tells you whether the extension is loaded. The second shows the checked out commit if you installed it from git. Compare it with the project's repository history for the fix of the line named in the advisory.
You can also open Special:Version on the wiki to see the installed version of each extension. If the extension is installed but not loaded in LocalSettings.php, the code is still on disk, so consider removing it.
What to do now
- Confirm whether Tilesheets is enabled on any wiki you operate, including staging and archived copies.
- Read the GitHub advisory and the repository for the current fix status and update to a version that includes the corrected query.
- If no fix is available for your branch, disable the extension until one is, or restrict who can reach the affected special page.
- Make sure the database account used by MediaWiki has only the privileges the wiki needs, so a query bug has less to work with.
- Review web logs for odd requests to the affected special page with unusual characters in the query string.
Why it matters
This is classic SQL injection. The application built a query with a column name that was missing its closing backtick, so text supplied by a user could change the shape of the statement rather than just fill in a value. The fix class is the same everywhere: use the query builder or parameter binding correctly and never assemble SQL by concatenation.
The case is a good reminder that small typos can be security bugs. A single missing character was enough to open a path from request to database. Extensions are also easy to forget, because they sit outside the core upgrade path. The CVE is not on the CISA KEV list.
The weakness is classed as CWE-89 (SQL Injection). Severity in the CVE record: high, CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Quick check
Is a fixed version available?
The sources disagree. The NVD text says the issue has not been fixed, and the GitHub advisory lists a patched version field. Check the repository and advisory before deciding.
What is the safest short term step?
If you cannot confirm a fixed commit, disable the extension or restrict access to the affected special page until you can.
Sources
- GitHub security advisory GHSA-hqfr-7cm9-4h87
- Source line referenced by the record (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
