Back to Database
Status published
Medium
CVE-2025-6590
Complete content leak of private wikis due to PasswordReset Wikitext injection in error message
Vulnerability Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php. This issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1, 1.44.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6590
Credits & Attribution
No credits recorded in the NVD database.
References
More from Wikimedia Foundation
View All →CVE-2025-7363
TitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser function
Unknown
0
CVE-2025-7362
MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message
Unknown
0
CVE-2025-7057
Stored XSS in Quiz
Unknown
0
CVE-2025-7056
Stored XSS in UrlShortener
Unknown
0
CVE-2025-6927
Autoblocks from global account suppressions are publicly visible
Low
2.3
Affected Vendor
Wikimedia Foundation
View all reports →Affected Software
MediaWiki
Vulnerable Versions:
*
Timeline
Official Publish:
February 2nd, 2026
Last Modified:
February 3rd, 2026
Added to House:
July 22nd, 2026