PT-2025-25348 · Citizen+1 · Citizen+1

Somemwdev · Published 2025-06-12 · Updated 2025-08-22 · CVE-2025-49579

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Citizen versions prior to 3.3.1

Description The issue affects the Citizen MediaWiki skin, where system messages in menu headings using the Menu.mustache template are inserted as raw HTML. This allows users with the editinterface right to insert arbitrary HTML into the DOM, potentially impacting wikis. The estimated number of affected devices and real-world incidents are not specified.

Recommendations For versions prior to 3.3.1, update to version 3.3.1 to resolve the issue. As a temporary workaround, consider restricting the editinterface user right to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-49579

GHSA-G3CP-PQ72-HJPV

Affected Products

Citizen

Mediawiki

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49579.json · Exploit
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/54c8717d45ce1594918f11cb9ce5d0ccd8dfee65 · Patch
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g3cp-pq72-hjpv · Vendor Advisory
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-49579 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49579 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g3cp-pq72-hjpv · Vendor Advisory
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen · Note
• https://t.me/latest_high_impact_cve/2632 · Telegram Post
• https://t.me/cvetracker/26120 · Telegram Post
• https://twitter.com/CVEnew/status/1933241175164530900 · Twitter Post
• https://t.me/cveNotify/133211 · Telegram Post