PT-2025-42685 · Wikimedia Foundation · Flexdiagrams Extension+1

Somerandomdeveloper · Published 2025-10-18 · Updated 2025-10-20 · CVE-2025-62670

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Mediawiki - FlexDiagrams Extension versions prior to master.

Description The Wikimedia Foundation Mediawiki - FlexDiagrams Extension contains a flaw related to improper input handling during web page generation, potentially leading to Stored Cross-site Scripting (XSS). This issue could allow an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability exists in the master branch of the FlexDiagrams Extension.

Recommendations Update to a version of the Mediawiki - FlexDiagrams Extension that addresses this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62670

Affected Products

Flexdiagrams Extension

Mediawiki

References · 7

• 🔥 https://phabricator.wikimedia.org/T402149 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62670 · Security Note
• https://t.me/cveNotify/139463 · Telegram Post
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FlexDiagrams/+/1179692 · Note
• https://twitter.com/CVEnew/status/1979409794227126460 · Twitter Post
• https://t.me/cveNotify/139319 · Telegram Post
• https://t.me/CVEtracker/35255 · Telegram Post