CVE-2025-43861: Miraheze ManageWiki XSS Vulnerability

CVE-2025-43861 Overview

CVE-2025-43861 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in Miraheze ManageWiki, a MediaWiki extension used to manage wikis. Versions prior to commit 2f177dc render user-controlled form field content inside the "Review Changes" dialog without proper sanitization. A logged-in attacker who modifies a form field to include a malicious payload triggers script execution when the same session opens the review dialog. The flaw allows both reflected and stored XSS conditions within the administrator's own browsing context.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the ManageWiki review dialog, enabling session-context script execution against wiki administrators.

Affected Products

Miraheze ManageWiki (MediaWiki extension)
All versions prior to commit 2f177dc83b28b727613215b835d4036cb179e4ab
Deployments exposing the ManageWiki Review Changes dialog to authenticated users

Discovery Timeline

2025-04-24 - CVE-2025-43861 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43861

Vulnerability Analysis

ManageWiki exposes a "Review Changes" dialog that summarizes pending configuration modifications before a user saves them. Prior to the patch, the dialog constructed its output on the client side by concatenating raw field values into HTML strings rather than using localized, escaped message parameters. When a logged-in user placed HTML or JavaScript in a form field and opened the review dialog, the payload rendered as markup and executed inside the current session context.

Because the payload persists in the form state until submission, the flaw supports both reflected use (immediate payload injection followed by review) and stored patterns when values traverse cached form state. Exploitation requires authentication and user interaction, which limits mass exploitation but remains relevant in multi-user wiki farms where operators share administrative tooling.

Root Cause

The root cause is missing output encoding in the client-side review dialog. The dialog assembled change summaries as raw HTML using unlocalized string concatenation instead of parameterized MediaWiki i18n messages. Without HTML entity escaping on field names and values, any attacker-controlled input containing markup was interpreted as DOM content by the browser.

Attack Vector

An authenticated ManageWiki user submits a crafted value into a settings form field. When the user opens the Review Changes dialog, the JavaScript that builds the change list injects the unescaped value directly into the dialog DOM, executing the payload in the browser session.

text

// Patch excerpt: extension.json — new localized messages registered
"messages": [
    "managewiki-review-changed",
    "managewiki-review-disabled",
    "managewiki-review-enabled",
    "managewiki-review-nochanges",
    "managewiki-review-none",
    "managewiki-review-title",
    "managewiki-review-toggled",
    "managewiki-save",
    "managewiki-search-noresults",
    "managewiki-warning-changes"
]

// Patch excerpt: i18n/en.json — parameterized, escaped messages
"managewiki-review-changed": "$1 was changed from $2 to $3",
"managewiki-review-disabled": "disabled",
"managewiki-review-enabled": "enabled",
"managewiki-review-nochanges": "No changes made.",
"managewiki-review-none": "<none>",
"managewiki-review-title": "Review Changes",
"managewiki-review-toggled": "$1 was $2"

Source: GitHub Commit 2f177dc

Detection Methods for CVE-2025-43861

Indicators of Compromise

Unexpected <script>, onerror=, or javascript: fragments stored in ManageWiki form fields or configuration change logs
Browser console errors or DOM anomalies observed by administrators after opening the Review Changes dialog
ManageWiki audit entries showing configuration fields containing HTML metacharacters submitted by low-privilege users

Detection Strategies

Review MediaWiki request logs for POST bodies to ManageWiki special pages that contain HTML tags or JavaScript event handlers in field values.
Inspect the deployed extension version and compare against commit 2f177dc; earlier commits are vulnerable.
Add server-side content inspection on ManageWiki form submissions to flag payloads containing script-related tokens.

Monitoring Recommendations

Monitor administrator accounts for anomalous session activity following ManageWiki configuration reviews.
Enable and centrally collect MediaWiki Special:Log entries for ManageWiki changes and correlate with browser telemetry.
Alert on new outbound requests originating from administrator browsers immediately after ManageWiki dialog interactions.

How to Mitigate CVE-2025-43861

Immediate Actions Required

Update ManageWiki to a build that includes commit 2f177dc83b28b727613215b835d4036cb179e4ab or later.
Audit recent ManageWiki configuration changes for HTML or script content submitted by any user.
Rotate administrative session tokens for any account that opened the Review Changes dialog on a vulnerable version.

Patch Information

The issue is fixed in ManageWiki commit 2f177dc, which replaces raw HTML string concatenation in the review dialog with parameterized MediaWiki i18n messages (managewiki-review-changed, managewiki-review-toggled, etc.). Details are available in the GitHub Security Advisory GHSA-859x-46h8-vcrv and the upstream patch commit.

Workarounds

Restrict access to ManageWiki special pages to a minimal set of trusted administrators until patching completes.
Deploy a Content Security Policy (CSP) that disallows inline script execution on MediaWiki pages hosting ManageWiki.
Instruct administrators to avoid opening the Review Changes dialog on untrusted or unreviewed form input while the extension is unpatched.

bash

# Update ManageWiki to the patched revision
cd /var/www/mediawiki/extensions/ManageWiki
git fetch origin
git checkout 2f177dc83b28b727613215b835d4036cb179e4ab
php /var/www/mediawiki/maintenance/update.php --quick