PT-2025-25346 · Mediawiki · Mediawiki Citizen Skin

Somemwdev · Published 2025-06-12 · Updated 2025-08-22 · CVE-2025-49576

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki Citizen Skin versions prior to 3.3.1

Description The issue concerns the Citizen MediaWiki skin, which allows extensions to be part of a cohesive experience. Specifically, the citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML. This allows anyone who can edit these messages to insert arbitrary HTML into the DOM, potentially leading to HTML injection.

Recommendations For versions prior to 3.3.1, update to version 3.3.1 to resolve the issue. As a temporary workaround, consider restricting access to editing the citizen-search-noresults-title and citizen-search-noresults-desc system messages until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-49576

GHSA-86XF-2MGP-GV3G

Affected Products

Mediawiki Citizen Skin

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49576.json · Exploit
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/a0296afaedbe1a277337a2d8f1da83cb3a79b9ab · Patch
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd · Patch
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-86xf-2mgp-gv3g · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-86xf-2mgp-gv3g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49576 · Security Note
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen · Note
• https://twitter.com/CVEnew/status/1933241173381971969 · Twitter Post
• https://t.me/latest_high_impact_cve/2632 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1933286075058852138 · Twitter Post
• https://t.me/cvenotify/125540 · Telegram Post
• https://t.me/cvetracker/26117 · Telegram Post
• https://t.me/cveNotify/133208 · Telegram Post