~ / search / GHSA-c3h5-h73c-29hq

GHSA-c3h5-h73c-29hq

Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-23081

Packages

EcosystemPackageAffectedFixed in
Packagist mediawiki/data-transfer >= 1.39.0, < 1.39.11 1.39.11
Packagist mediawiki/data-transfer >= 1.41.0, < 1.41.3 1.41.3
Packagist mediawiki/data-transfer >= 1.42.0, < 1.42.2 1.42.2

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

References

External links from the advisory. They lead to third-party sites.