CVE-2025-62699

MediumCVSS 6.9

Published: 21/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

The Translate extension in MediaWiki (Wikimedia Foundation) has a vulnerability exposing sensitive information to unauthorized actors. The extension uses jobs to make edits to translation pages, causing CheckUser to log the wrong IP and User-Agent, making these edits unauditable via CheckUser. This affects versions from master before 1.39.

Risk Assessment

Lack of edit auditability could hide malicious activities, potentially leading to unauthorized content changes and hindering attack detection.

Recommendation

Update the Translate extension to version 1.39 or later and review CheckUser logs for anomalies.

Other vulnerabilities in MediaWiki Translate Extension

CVE-2026-100378Medium
The Translate extension for MediaWiki has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

Original NVD description (English source)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Translate extension appears to use jobs to make edits to translation pages. This causes the CheckUser tool to log the wrong IP and User-Agent making these edits un-auditable via the CheckUser tool.This issue affects Mediawiki - Translate Extension: from master before 1.39.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS