CVE-2014-9487: The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read...

Security readout for executives and security teams

CVE-2014-9487 affects older MediaWiki releases that bundled getID3. A remote attacker could abuse XML external entity processing to read files from the server or disrupt service. The sources identify fixed MediaWiki releases, but provide no CVSS score and no evidence of active exploitation. Exposure is most likely on internet-facing MediaWiki installations running versions older than the listed security releases, especially systems allowing media upload or metadata processing. The source bundle lacks specific CPEs or package inventory details. Treat this as a necessary cleanup item for any remaining legacy MediaWiki environment. Prioritize public-facing or sensitive-data wikis, but do not label it emergency without evidence of exposure or active exploitation. Mitigation focus: Upgrade MediaWiki to 1.24.1, 1.23.8, 1.22.15, 1.19.23, or a later supported release.; Apply vendor or distribution security updates, including relevant Gentoo guidance where applicable.; Retire unsupported MediaWiki branches that cannot receive security fixes..

Prepared

Jun 12, 2026, 20:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.