CVE-2025-53371: RCE in DiscordNotifications for MediaWiki

The DiscordNotifications extension, designed to send MediaWiki actions to Discord, introduces a significant security risk due to its handling of external URLs. The vulnerability stems from the extension's use of curl and filegetcontents to send requests to arbitrary URLs specified in $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls. An attacker can leverage this to trigger Denial of Service (DoS) attacks by causing the server to read large files. Furthermore, Server-Side Request Forgery (SSRF) becomes possible if internal, unprotected APIs are accessible via HTTP POST requests, potentially escalating to Remote Code Execution. This represents a severe compromise, allowing attackers to gain complete control over the MediaWiki server.

1. Reserved2025-06-27
2. Published2025-07-10
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-53371 is to immediately upgrade the DiscordNotifications extension to version 1f20d850cbcce5b15951c7c6127b87b927a5415e. If upgrading is not immediately feasible, consider temporarily disabling the DiscordNotifications extension. As a secondary measure, implement strict input validation and sanitization for the $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls configuration variables to prevent malicious URL injection. Review and restrict network access to internal APIs to prevent SSRF exploitation. After upgrading, confirm the fix by attempting to trigger a notification with a URL pointing to a non-existent resource; the server should not attempt to access the resource.