CVE-2025-25287

Vulnerability

Overview

CVE-2025-25287 is a stored cross-site scripting (XSS) issue in the Lakeus skin for MediaWiki, affecting versions 1.0.8 through before 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0 [1]. The root cause is that system messages, such as lakeus-footermessage and those used in themeDesigner.js, are rendered without proper escaping, allowing an attacker with (editinterface) rights to inject raw HTML [2][4].

Attack

Surface and Exploitation

Exploitation requires high privileges, specifically the editinterface permission, which is typically granted only to trusted users like administrators [1][4]. The attacker modifies an affected system message (e.g., lakeus-footermessage) to contain an XSS payload. In the case of lakeus-footermessage, this payload is served to all users if the server is configured to link back to the Lakeus repository. For messages used by themeDesigner.js, the attack only affects users who have enabled the theme designer in their preferences [2][4].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of other users' browsers. This could lead to session hijacking, defacement, or further malicious actions within the MediaWiki instance. The impact is limited to users who are either accustomed to a specific server configuration or actively use the custom styling feature [1][4].

Mitigation

The vulnerability has been patched in versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0. Administrators are advised to update Lakeus to one of these patched releases. The fix ensures that system messages are properly escaped using methods such as .escaped() instead of raw message output [1][3]. There is no known workaround, and the vendor recommends upgrading [4].