Vulnerability in Weirdgloop Mediawiki-extensions-bucket
CVE-2025-61766
Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a bucket using the `!=` comparator. This will result in PHP's call stack limit exceed…
EPSS: 0.000 (12.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Weirdgloop Mediawiki-extensions-bucket — versions < 1.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/weirdgloop/mediawiki-extensions-Bucket/security/advisories/GHSA-r9f2-4jh3-659j (x_refsource_CONFIRM)
- https://github.com/weirdgloop/mediawiki-extensions-Bucket/commit/6f4a71d531cb802cdb991d2a4ca7bf8fb691defd (x_refsource_MISC)
- https://github.com/weirdgloop/mediawiki-extensions-Bucket/blob/ad704120a1660b5929fb5825db1cf85c9c77acf4/includes/Expression/MemberOfExpression.php#L34 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-61766?
- CVE-2025-61766 is a medium-severity vulnerability in Weirdgloop Mediawiki-extensions-bucket, classified under Uncontrolled Recursion. CVSS score: 6.5/10. Published 2025-10-06.
- How severe is CVE-2025-61766?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2025-61766 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.