Read the docs
TI-2025-33333 Aliases CVE-2025-53371

DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending requests via curl and file_get_contents to arbitrary URLs set via $wgDiscordIncomingWebhookUrl and $wgDiscordAdditionalIncomingWebhookUrls. This allows for DOS by causing the server to read large files. SSRF is also possible if there are internal unprotected APIs that can be accessed using HTTP POST requests, which could also possibly lead to RCE. This vulnerability is fixed in commit 1f20d850cbcce5b15951c7c6127b87b927a5415e.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Fix Fixed DiscordNotifications (miraheze): 1f20d850cbcce5b15951c7c6127b87b927a5415e

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mirahezeDiscordNotificationsbefore 1f20d850cbcce5b15951c7c6127b87b927a5415e1f20d850cbcce5b15951c7c6127b87b927a5415ePatch availableCNA
  • DiscordNotifications Vendormiraheze Affected before 1f20d850cbcce5b15951c7c6127b87b927a5415e Fixed in 1f20d850cbcce5b15951c7c6127b87b927a5415e Patch available CNA

Remediation

  • Fix · CNA DiscordNotifications (miraheze) Fixed in 1f20d850cbcce5b15951c7c6127b87b927a5415e

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53371

References

Other 2

  • TI-2024-16562 Cross-Site Scripting in WikiDiscover CVSS 3.1MEDIUM 6.1
  • TI-2021-10196 wikiconfig API leaked private config variables set through ManageWiki CVSS 3.1CRITICAL 9.4
  • TI-2025-23966 ManageWiki has SQL injection vulnerability in NamespaceMigrationJob CVSS 3.1HIGH 8.0
  • TI-2026-23374 TSPortal: Anyone can forge self-deletion requests of any user CVSS 4.0HIGH 8.4
  • TI-2024-32057 Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover CVSS 3.1HIGH 7.6
  • TI-2022-08626 Authentication Bypass Using an Alternate Path or Channel in CreateWiki CVSS 3.1MEDIUM 5.3
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences