Exploring MediaWiki's Latest Security Enhancements

MediaWiki security work happens in two places: point releases that fix discovered vulnerabilities, and feature releases that change the security model. If you administer a wiki, both matter — the first decides what you patch, the second what you configure. This article covers what actually changed across the 1.43 LTS, 1.44 and 1.45 releases, followed by a hardening checklist that holds regardless of version.

Recent security fixes

The 1.43 and 1.44 lines both received multiple security maintenance releases (1.43.x and 1.44.x series). The patches that stand out:

• XSS fixes — escaping of system messages in live preview and mw.language.listToText (CVE-2025-11261), escaping of rawElement content, submission button labels in Codex forms, and sanitizing data- attributes (CVE-2025-61636/61637/61638/61642)
• Information disclosure — suppressed recent changes no longer reach RCFeeds, and hidden usernames are not leaked through watchlist/recent changes (CVE-2025-61643/61646)
• API and RSS — escaping of i18n messages in action=feedcontributions (CVE-2025-6591) and cache-control on REST redirects (CVE-2025-61634)
• Parsoid updates — one security fix shipped via a Parsoid bump alone (CVE-2025-32699)

None of these are exotic; all were fixed in source and point releases. The lesson is operational: run a supported line and apply point releases — 1.43 is LTS-supported, 1.44/1.45 are supported, anything older than 1.39 is out of scope for patches.

Security-relevant changes in recent releases

• 1.43 — raw HTML in copyright messages off: $wgAllowRawHtmlCopyrightMessages now defaults to false, protecting against a rogue admin exploiting the footer hook; removable entirely in 1.45
• 1.43 — temporary accounts mature: with $wgAutoCreateTempUser, anonymous editors get temporary accounts, and since 1.43 also on failed edits and null edits, which improves moderation and logging
• 1.43 — XSLT disabled by default in the API's XML handling (CVE fix line)
• 1.44 — DNSBL cleanup: the obsolete sorbs.net blocklist entry was dropped from $wgDnsBlacklistUrls; if you relied on it, it silently does nothing
• 1.45 — partial action blocks default-on: administrators can now block users from specific actions (moving pages, uploading) without disabling editing — the tooling that once required extension work is now standard
• 1.45 — PHP session handling deprecated: extensions touching $_SESSION now emit warnings; integration will be removed, which matters for any extension that shares PHP sessions

Evergreen hardening checklist

Version-independent configuration that should be checked on every MediaWiki install:

• HTTPS everywhere — $wgServer = 'https://...', $wgCanonicalServer, HSTS header; session cookies must never travel over HTTP
• Password policy — enforce a minimum complexity via $wgPasswordPolicy defaults, and seriously consider two-factor authentication for administrators (TOTP is built in)
• Rate limiting — $wgRateLimits on edits and password attempts, plus fail2ban at the network level for login brute-force (see the dedicated fail2ban article on this blog)
• Account lockdown — block the 'block' of stale admin accounts; review Special:ListGroupRights and remove global 'patrol'/'rollback' from groups that do not need it
• Extension hygiene — uninstall extensions you do not use (every extension is attack surface), pin versions, and watch the security advisories feed
• Uploads — restrict $wgFileExtensions to what the wiki needs (svg files especially: MediaWiki sanitizes them, but only if the sanitizer path works — test)
• AbuseFilter — a basic filter set catches the deformation attacks (spam, vandalism patterns) that drive most incident load

Operational posture

MediaWiki publishes security advisories through the mediawiki-announce mailing list, which is the authoritative channel — subscribe to it and track release notes for your line. Run a supported release (1.39+ is the practical floor; the 1.43 LTS is the recommended base as of 2026), apply point releases promptly, and re-run the hardening checklist at every major upgrade. The security manual on mediawiki.org remains the definitive reference.