Stored XSS Vulnerability in MsUpload Extension for MediaWiki
CVE-2025-7362

5.4MEDIUM

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki - Msupload Extension
Vendor
CVE Published:
8 July 2025

What is CVE-2025-7362?

The MsUpload extension for MediaWiki contains a vulnerability allowing stored XSS via the msu-continue system message. This issue arises when users upload a file with the same name twice, leading to the injection of unsafe content into the DOM without adequate sanitization, potentially compromising the security of the web application and its users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Mediawiki - MsUpload extension 1.39.x < 1.39.13

Mediawiki - MsUpload extension 1.42.x < 1.42.7

Mediawiki - MsUpload extension 1.43.x < 1.43.2

References

https://phabricator.wikimedia.org/T394864
https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.