CVE-2025-61645 Overview
CVE-2025-61645 is a Cross-Site Scripting (XSS) vulnerability affecting Wikimedia Foundation's MediaWiki platform. The vulnerability stems from improper neutralization of input during web page generation within the includes/pager/CodexTablePager.php file. This security flaw allows attackers to inject malicious scripts into web pages viewed by other users.
Critical Impact
Authenticated attackers with high privileges may exploit this XSS vulnerability to inject malicious scripts, potentially leading to session hijacking, data theft, or unauthorized actions on behalf of other users.
Affected Products
- MediaWiki versions before 1.44.1
Discovery Timeline
- 2026-02-03 - CVE-2025-61645 published to NVD
- 2026-02-03 - Last updated in NVD database
Technical Details for CVE-2025-61645
Vulnerability Analysis
This vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). The flaw exists in the CodexTablePager.php file within MediaWiki's pager functionality.
The vulnerability arises when user-supplied input is not properly sanitized before being rendered in web pages. When exploited, an attacker can inject arbitrary JavaScript or HTML content that executes in the context of a victim's browser session. This is particularly concerning in wiki environments where content is frequently shared and viewed by multiple users.
The attack requires network access and high privileges on the affected MediaWiki installation. While the current CVSS 4.0 assessment indicates no direct confidentiality, integrity, or availability impact, XSS vulnerabilities can serve as stepping stones for more severe attacks including credential theft, session hijacking, and social engineering attacks against wiki users.
Root Cause
The root cause of this vulnerability lies in insufficient input validation and output encoding within the CodexTablePager.php component. MediaWiki's pager functionality fails to properly sanitize user-controlled input before incorporating it into HTML output, allowing malicious script content to bypass security controls and render in the browser.
Attack Vector
The attack vector is network-based, requiring an authenticated attacker with high-level privileges to exploit this vulnerability. The attacker would craft malicious input containing JavaScript payloads that, when processed by the vulnerable CodexTablePager component, would be rendered without proper sanitization. Victims viewing pages containing the injected content would have the malicious scripts executed in their browser context.
The vulnerability manifests in the pager rendering functionality where user input flows through the CodexTablePager.php file without adequate sanitization. For detailed technical information, refer to the Wikimedia Task T403761.
Detection Methods for CVE-2025-61645
Indicators of Compromise
- Unexpected JavaScript execution or browser alerts when viewing MediaWiki pages containing table pager elements
- Unusual HTML or script tags appearing in page content or URL parameters related to pager functionality
- Web application firewall logs showing XSS payload patterns in requests to MediaWiki endpoints
Detection Strategies
- Implement web application firewall (WAF) rules to detect common XSS payload patterns in requests targeting MediaWiki installations
- Monitor server access logs for suspicious requests containing encoded script tags or JavaScript event handlers
- Deploy Content Security Policy (CSP) headers and monitor violation reports for script execution attempts
Monitoring Recommendations
- Enable verbose logging for MediaWiki and review logs for unusual activity patterns
- Monitor for user complaints about unexpected browser behavior when interacting with wiki pages
- Implement automated scanning of MediaWiki installations to detect unpatched versions prior to 1.44.1
How to Mitigate CVE-2025-61645
Immediate Actions Required
- Upgrade MediaWiki to version 1.44.1 or later immediately
- Review recent changes to wiki pages for potential malicious content injection
- Implement Content Security Policy (CSP) headers to mitigate XSS impact as a defense-in-depth measure
Patch Information
Wikimedia Foundation has addressed this vulnerability in MediaWiki version 1.44.1. Organizations running affected versions should prioritize upgrading to the patched release. For detailed information about the vulnerability and remediation, refer to the Wikimedia Task T403761.
Workarounds
- Implement strict Content Security Policy (CSP) headers that restrict inline script execution
- Apply WAF rules to filter potential XSS payloads targeting the affected pager component
- Limit access to high-privilege accounts that could potentially exploit this vulnerability
# Example CSP header configuration for Apache
# Add to your MediaWiki's .htaccess or virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
