CVE-2025-67484 is a critical flaw (CVSS 9.8) in MediaWiki, tied to includes/Api/ApiFormatXml.php. It affects releases before 1.39.16, 1.43.6, 1.44.3 and 1.45.1. Upgrade to the fixed release on your branch. The public record gives few technical details, so treat the version as the test.
What's affected
- MediaWiki before 1.39.16 on the 1.39 branch.
- MediaWiki before 1.43.6 on the 1.43 branch.
- MediaWiki before 1.44.3 on the 1.44 branch.
- MediaWiki before 1.45.1 on the 1.45 branch.
- Affected file: includes/Api/ApiFormatXml.php.
How to check if you're exposed
Open Special:Version on your wiki. It prints the MediaWiki version at the top. The version is also in the release files you deployed.
Compare the version with the fixed releases for your branch. The Wikimedia task for this issue is behind a login, so the public text is the CVE record only. Check the MediaWiki release announcement for the version you plan to move to.
What to do now
- Find every MediaWiki install, including internal wikis and test copies.
- Upgrade to 1.39.16, 1.43.6, 1.44.3 or 1.45.1, whichever matches your branch, or move to a newer branch.
- Back up the database and the LocalSettings.php file first.
- Review extensions for compatibility with the target release.
- Check the web server logs for unusual requests to the API with the XML output format, as a precaution.
Wikis tend to collect old branches, because each one holds content that someone relies on. This is a good moment to list every wiki, its branch and its owner, and to retire the ones nobody uses. Fewer installs means fewer places to patch the next time an advisory like this appears.
Why it matters
The record maps this to CWE-20, improper input validation, in the code that renders API responses as XML. It gives no exploit detail, and this post does not add any.
The vector shows network access with no privileges, no user interaction and high impact across all three areas. Wikis are often open to anonymous users and often left on older branches, which makes patching the whole fleet the main job. The record does not list this CVE as exploited in the wild.
Quick check
Which MediaWiki release fixes CVE-2025-67484?
The first fixed release on each branch: 1.39.16, 1.43.6, 1.44.3 and 1.45.1.
Sources
Last reviewed: 19 October 2026.
