XSS in Wikimedia Foundation Mediawiki - Msupload Extension
CVE-2025-7362
The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice. This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (7.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Wikimedia Foundation Mediawiki - Msupload Extension — versions 1.39.x, 1.42.x, 1.43.x
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-7362?
- CVE-2025-7362 is a medium-severity vulnerability in Wikimedia Foundation Mediawiki - Msupload Extension, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-07-08.
- How severe is CVE-2025-7362?
- Medium severity. CVSS v3 base score is 5.4 out of 10.