Improper Input Validation in Mediawiki - Wikidata Extension by Wikimedia Foundation

CVE-2025-32071

What is CVE-2025-32071?

The Wikimedia Foundation's Mediawiki - Wikidata Extension suffers from an improper input validation vulnerability that allows for Cross-Site Scripting (XSS) attacks. This security issue arises from inadequate handling of user input through the widthheight message in the ImageHandler::getDimensionsString() function. The flaw can be exploited in versions 1.39 to 1.43, facilitating the injection of malicious scripts. Users and administrators of affected versions are urged to apply the necessary patches to safeguard their applications.

References