Improper Input Validation in Mediawiki - Wikidata Extension by Wikimedia Foundation
CVE-2025-32071
10CRITICAL
Summary
The Wikimedia Foundation's Mediawiki - Wikidata Extension suffers from an improper input validation vulnerability that allows for Cross-Site Scripting (XSS) attacks. This security issue arises from inadequate handling of user input through the widthheight message in the ImageHandler::getDimensionsString() function. The flaw can be exploited in versions 1.39 to 1.43, facilitating the injection of malicious scripts. Users and administrators of affected versions are urged to apply the necessary patches to safeguard their applications.
Affected Version(s)
Mediawiki - Wikidata Extension 1.39 <= 1.43
References
CVSS V4
Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Lucas_Werkmeister_WMDE