CVE-2025-7362

Published: Jul 8, 2025Modified: Jun 17, 2026Deferred

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice. This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

https://phabricator.wikimedia.org/T394864

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

https://phabricator.wikimedia.org/T394864

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.