CVE-2025-53371 is a critical server-side request forgery (SSRF) and denial-of-service (DoS) vulnerability affecting the DiscordNotifications extension for MediaWiki. It allows authenticated attackers to trigger requests to arbitrary URLs via curl or file_get_contents, potentially leading to DoS by reading large files or RCE through internal API access. With a CVSS score of 9.1 (CRITICAL), the vulnerability is easily exploitable over the network with low privileges and no user interaction, posing a significant risk of high impact to availability and some impact to confidentiality and integrity. There is currently no public exploit code or evidence of active exploitation, and it has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Miraheze | DiscordNotifications | < 1f20d850cbcce5b15951c7c6127b87b927a5415eCNA affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 1.0 Bluesky, 0.5 Mastodon, and 1.6 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.