Vulnerability · Published Feb 3, 2026 · Assigned by wikimedia-foundation
CVE-2025-61649UserInfoCard: Check that performing user has permission to view log entries for number of past blocks
Low 1.1
In plain English
A low-severity path traversal in CheckUser from Wikimedia Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 4.0)1.1Low
Exploit odds (30 days)0.4%top 68.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Services/CheckUserUserInfoCardService.Php. This issue affects CheckUser: from 7cedd58781d261f110651b6af4f41d2d11ae7309.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wikimedia Foundation | CheckUser | 7cedd58781d261f110651b6af4f41d2d11ae7309 – before * |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U