PT-2025-25347 · Citizen · Citizen

Somemwdev · Published 2025-06-12 · Updated 2025-08-22 · CVE-2025-49578

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Citizen versions prior to 3.3.1

Description The issue affects the Citizen MediaWiki skin, which integrates extensions into a cohesive experience. It allows users with the editinterface right to insert arbitrary HTML into the DOM by editing date messages returned by Language::userDate, potentially leading to security issues. This is particularly concerning for wikis where users have the editinterface but not the editsitejs user right.

Recommendations For versions prior to 3.3.1, update to version 3.3.1 to resolve the issue. As a temporary workaround, consider restricting the editinterface user right to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-49578

GHSA-2V3V-3WHP-953H

Affected Products

Citizen

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49578.json · Exploit
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/64cb5d7ab3a6dc0381fae54b31e8fc4afadc8beb · Patch
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd · Patch
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-2v3v-3whp-953h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49578 · Security Note
• https://osv.dev/vulnerability/GHSA-2v3v-3whp-953h · Vendor Advisory
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen · Note
• https://t.me/latest_high_impact_cve/2632 · Telegram Post
• https://t.me/cvetracker/26119 · Telegram Post
• https://t.me/cveNotify/133210 · Telegram Post
• https://twitter.com/CVEnew/status/1933241174283735448 · Twitter Post