CVE-2015-8625: Mediawiki

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.

Affected products

• Mediawiki Mediawiki: up to and including 1.23.11; version 1.24.0 only; version 1.24.1 only; version 1.24.2 only; version 1.24.3 only; version 1.24.4 only; …

Published 2017-03-23. Last modified 2026-06-17.