What’s Vulnerable › Vulnerabilities

CVE-2025-7362: MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-08 · updated 2026-06-17
• Weakness: CWE-79

Description

The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice. This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Affected products

• Wikimedia Foundation Mediawiki - MsUpload extension: from 1.39.x before 1.39.13; from 1.42.x before 1.42.7; from 1.43.x before 1.43.2 — fixed in 1.39.13, 1.42.7, 1.43.2

How to fix

Upgrade to a fixed version: Wikimedia Foundation Mediawiki - MsUpload extension 1.39.13, 1.42.7, 1.43.2. Check the vendor advisory for mitigations.

References

• https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f
• https://phabricator.wikimedia.org/T394864
• https://phabricator.wikimedia.org/T394864

Get alerted when CVE-2025-7362 or the next vulnerability affects your stack