PT-2025-25344 · Mediawiki · Mediawiki Citizen Skin

Somemwdev · Published 2025-06-11 · Updated 2025-08-22 · CVE-2025-49575

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions mediawiki-skins-Citizen versions prior to 3.3.1

Description The issue affects MediaWiki skin Citizen, allowing stored XSS in Command Palette tip messages. This occurs because multiple system messages are inserted into the CommandPaletteFooter as raw HTML, enabling anyone who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the editinterface but not the editsitejs user right.

Recommendations For versions prior to 3.3.1, update to version 3.3.1 to resolve the issue. As a temporary workaround, consider restricting the editinterface user right to prevent unauthorized editing of system messages.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-49575

GHSA-4C2H-67QQ-VM87

Affected Products

Mediawiki Citizen Skin

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49575.json · Exploit
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-4c2h-67qq-vm87 · Vendor Advisory
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/4fa69e1d062dca7e407cc0530cf1da3e2baaf0b5 · Patch
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd · Patch
• https://osv.dev/vulnerability/CVE-2025-49575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49575 · Security Note
• https://osv.dev/vulnerability/GHSA-4c2h-67qq-vm87 · Vendor Advisory
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen · Note
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/54c8717d45ce1594918f11cb9ce5d0ccd8dfee65 · Note
• https://twitter.com/CVEnew/status/1933235321736503485 · Twitter Post
• https://t.me/cvetracker/26116 · Telegram Post
• https://t.me/cveNotify/133215 · Telegram Post
• https://t.me/latest_high_impact_cve/2633 · Telegram Post
• https://t.me/cvenotify/125539 · Telegram Post