CVE-2025-32698 LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions
Attackers can view suppressed log entries due to incorrect enforcement of suppression restrictions in MediaWiki's LogPager component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-32698?
CVE-2025-32698 is a low-severity vulnerability in Wikimedia Foundation MediaWiki, published on 10 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/LogPager.Php.
This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.
Weakness: CWE-200
Which versions are affected by CVE-2025-32698?
1 open source package ship an affected version, including mediawiki.
| Package | Affected | Fixed in |
|---|---|---|
mediawiki Bitnami | All versions | 1.41.1, 1.43.1 |
How do I fix CVE-2025-32698?
Upgrade mediawiki to a fixed version for your release line: 1.41.1 or 1.43.1.
Is CVE-2025-32698 being exploited?
There is no known exploitation of CVE-2025-32698 in the wild and no public exploit code.
Sources
Also known as BIT-mediawiki-2025-32698, DEBIAN-CVE-2025-32698, GHSA-hh2q-7x5p-j2g2, UBUNTU-CVE-2025-32698.