CVE-2025-7362

Published Jul 8, 2025

Last updated 8 days ago

CVSS medium 5.4

Overview

Description
The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice. This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Source
c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
5.4
Impact score
2.7
Exploitability score
2.3
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity
MEDIUM

Weaknesses

c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
CWE-79

Social media

Hype score
Not currently trending

  1. CVE-2025-7362 The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vu… https://t.co/2R0JpAzXR7

    @CVEnew

    8 Jul 2025

    433 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

References

Sources include official advisories and independent security research.