Expression Language Injection Vulnerability in Wikimedia Foundation Mediawiki DiscussionTools Extension

CVE-2025-11175

What is CVE-2025-11175?

The Mediawiki DiscussionTools Extension from the Wikimedia Foundation contains a vulnerability that allows for Expression Language Injection, leading to Regular Expression Exponential Blowup. This flaw can potentially be exploited by attackers to execute malicious expressions, which may cause significant performance degradation or allow unauthorized access to sensitive data. Affected versions include 1.44 and 1.43, necessitating immediate attention from users to patch or update their installations.

References