CVE-2025-23081

Vulnerability

Overview

The DataTransfer extension for MediaWiki is affected by both Cross-Site Request Forgery (CSRF) and multiple Cross-Site Scripting (XSS) vulnerabilities [1][2]. These flaws stem from improper neutralization of input during web page generation and a lack of CSRF protections in import functionality [1]. A spontaneous security review identified approximately nine XSS issues and the ability to import pages while the user is blocked, in addition to the CSRF vector [2].

Exploitation

Conditions

An attacker can exploit the CSRF vulnerability by tricking an authenticated wiki user into performing unintended actions, such as importing malicious data [1][2]. The XSS issues allow injection of arbitrary script code into pages viewed by other users [1]. Exploitation does not require special network access; only a valid user session is needed for CSRF, and the XSS vectors rely on user interaction with crafted content.

Potential

Impact

Successful CSRF attacks can lead to unauthorized data import, potentially overwriting legitimate wiki content with attacker-controlled data [2]. The XSS vulnerabilities enable attackers to execute arbitrary JavaScript in the context of other users' sessions, which can result in session hijacking, defacement, or theft of sensitive information [1]. The combined attack surface increases the risk for wikis running affected versions.

Mitigation

Status

The vulnerabilities affect DataTransfer extension versions from 1.39.X before 1.39.11, 1.41.X before 1.41.3, and 1.42.X before 1.42.2 [1]. Patches have been proposed and the issue is tracked in the Wikimedia Phabricator [2]. Administrators should update to the latest patched version of the extension immediately. The extension is not hosted in Wikimedia production, so individual wiki operators must apply the fix [2].