PT-2025-27830 · Mediawiki · Mediawiki Citizen Skin

Somemwdev · Published 2025-07-03 · Updated 2025-07-03 · CVE-2025-53368

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Citizen MediaWiki skin versions 1.9.4 through 3.4.0

Description: The Citizen MediaWiki skin has an issue where page descriptions are inserted into raw HTML without proper sanitization when using the old search bar. This allows any user with page editing privileges to insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages.

Recommendations: For versions 1.9.4 through 3.4.0, update to version 3.4.0 to resolve the issue. As a temporary workaround, consider disabling the old search bar until a patch is available. Restrict access to page editing privileges to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-53368

GHSA-RQ6G-6G94-JFR4

Affected Products

Mediawiki Citizen Skin

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53368.json · Exploit
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/aedbceb3380bb48db6b59e272fc187529c71c8ca · Patch
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-rq6g-6g94-jfr4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53368 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53368 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rq6g-6g94-jfr4 · Vendor Advisory
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen · Note
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases/tag/v3.4.0 · Note
• https://twitter.com/CVEnew/status/1940861568998429033 · Twitter Post
• https://twitter.com/CveFindCom/status/1940858137247904112 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1940906315343179947 · Twitter Post