CVE-2025-62655: SQL injection in Cargo via Special:CargoExport
Published Oct 17, 2025
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows SQL Injection.This issue affects MediaWiki Cargo extension: 1.39, 1.43, 1.44.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki Cargo extension>=1.39<1.44
Event History
Oct 17, 2025
CVE Published
via MITRE·10:46 PM
Data Sourced
via MITRE·10:46 PM
DescriptionWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-62655?
CVE-2025-62655 is classified as a critical severity SQL Injection vulnerability.
2
How do I fix CVE-2025-62655?
To mitigate CVE-2025-62655, update the MediaWiki Cargo extension to a version higher than 1.44.
3
What versions of the MediaWiki Cargo extension are affected by CVE-2025-62655?
CVE-2025-62655 affects MediaWiki Cargo extension versions 1.39 to 1.44.
4
What type of vulnerability is CVE-2025-62655?
CVE-2025-62655 is an SQL Injection vulnerability that results from improper neutralization of special elements in SQL commands.
5
Who is impacted by CVE-2025-62655?
Any users running the affected versions of the MediaWiki Cargo extension are at risk of exploitation due to CVE-2025-62655.