CVE-2025-11175 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 5%

Debian Releases

Debian Product

Codename

mediawiki

bookworm	1:1.39.17-1~deb12u1 not-affected
bookworm (security)	1:1.39.17-1~deb12u1 fixed
bullseye	1:1.35.13-1+deb11u2 not-affected
bullseye (security)	1:1.35.13-1+deb11u6 fixed
forky	1:1.43.6+dfsg-2 fixed
sid	1:1.43.6+dfsg-2 fixed
trixie	1:1.43.6+dfsg-1~deb13u1 fixed
trixie (security)	1:1.43.6+dfsg-1~deb13u1 fixed

Common Weakness Enumeration

CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
The software constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

References

https://gerrit.wikimedia.org/r/q/I126203ab1d3ec8c1719cbb5460a887e4d0c2cc6d

https://gerrit.wikimedia.org/r/q/I563219f3298a8740e158d130492bf3d2897784d7

https://phabricator.wikimedia.org/T364910

https://phabricator.wikimedia.org/T396248