MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message
Priority MEDIUM 58CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice. This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00198 9th percentileScored 2026-11-07
Fix Fixed Mediawiki - MsUpload extension (Wikimedia Foundation): 1.39.13, 1.42.7, 1.43.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wikimedia Foundation | Mediawiki - MsUpload extension | 1.39.x to before 1.39.13; 1.42.x to before 1.42.7; 1.43.x to before 1.43.2 | 1.39.13, 1.42.7, 1.43.2 | Patch available | CNA |
- Mediawiki - MsUpload extension VendorWikimedia Foundation Affected 1.39.x to before 1.39.13; 1.42.x to before 1.42.7; 1.43.x to before 1.43.2 Fixed in 1.39.13, 1.42.7, 1.43.2 Patch available CNA
Remediation
- Fix · CNA Mediawiki - MsUpload extension (Wikimedia Foundation) Fixed in 1.39.13, 1.42.7, 1.43.2
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7362
- 2026-10-03 Alias added: GHSA-pqmg-6grf-rg8c
References
More Wikimedia Foundation vulnerabilities
- TI-2025-11006 The compare API module breaks Extension:Lockdown CVSS 4.0CRITICAL 10.0
- TI-2024-32110 Backticks can allow the usage of not-allowed SQL functions CVSS 4.0HIGH 8.8
- TI-2026-65500 Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters CVSS 3.1HIGH 7.5
- TI-2026-64588 DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) CVSS 3.1HIGH 7.5
- TI-2026-42112 SQLi in Cargo extension via year range filter CVSS 4.0MEDIUM 6.9
- TI-2026-42110 Stored XSS through Cargo's map format CVSS 4.0MEDIUM 6.9
Sources
- CVE-2025-7362 · CVE Program
- CVE-2025-7362 · NVD
- FIRST EPSS
- GHSA-pqmg-6grf-rg8c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences