High severityNVD Advisory· Published Jan 30, 2026· Updated Apr 15, 2026

CVE-2025-11175

Description

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundation Mediawiki - DiscussionTools Extension allows Regular Expression Exponential Blowup.This issue affects Mediawiki - DiscussionTools Extension: 1.44, 1.43.

Affected products

Wikimedia Foundation/Mediawiki Extensions Discussiontoolsinferred
Range: =1.43, =1.44

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

gerrit.wikimedia.org/r/q/I126203ab1d3ec8c1719cbb5460a887e4d0c2cc6dnvd
gerrit.wikimedia.org/r/q/I563219f3298a8740e158d130492bf3d2897784d7nvd
phabricator.wikimedia.org/T364910nvd
phabricator.wikimedia.org/T396248nvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000