CVE-2025-7362
MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message
The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice. This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Reserved 2025-07-08 | Published 2025-07-08 | Updated 2025-07-10 | Assigner wikimedia-foundationCWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
phabricator.wikimedia.org/T394864
gerrit.wikimedia.org/...0a5a936926ea887ca2e48c3a7bd297201d9f
Support options
