CVE-2025-67475: MediaWiki XSS Vulnerability

CVE-2025-67475 Overview

CVE-2025-67475 is a Cross-Site Scripting (XSS) vulnerability affecting Wikimedia Foundation MediaWiki. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the includes/CommentFormatter/CommentParser.php component. This flaw allows attackers to inject malicious scripts that could be executed in the context of other users' browsers when viewing affected content.

Critical Impact

Successful exploitation could allow attackers to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or defacement of wiki content.

Affected Products

• MediaWiki versions before 1.39.16
• MediaWiki versions before 1.43.6
• MediaWiki versions before 1.44.3
• MediaWiki versions before 1.45.1

Discovery Timeline

• 2026-02-03 - CVE-2025-67475 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-67475

Vulnerability Analysis

This vulnerability stems from insufficient input sanitization in MediaWiki's comment parsing functionality. The CommentParser.php file is responsible for processing and formatting user-generated comments before rendering them on wiki pages. When user input containing malicious script content is processed through this parser, the application fails to properly neutralize dangerous characters and HTML entities, allowing the malicious content to be rendered as executable code in the browser.

The network-accessible nature of this vulnerability means that attackers can exploit it remotely without requiring prior authentication. Any user interacting with wiki pages containing malicious comment content could potentially trigger the XSS payload, making this a significant concern for public-facing MediaWiki installations.

Root Cause

The root cause lies in the CommentParser.php file's handling of user-supplied input. The comment formatting logic does not adequately escape or sanitize special characters that could be interpreted as HTML or JavaScript when rendered in a web browser. This allows attackers to craft specially formatted comments that bypass input validation and inject arbitrary script content into the page output.

Attack Vector

The attack vector is network-based, requiring no user interaction beyond viewing an affected page. An attacker can submit malicious content through any interface that utilizes the vulnerable comment parsing functionality. When legitimate users subsequently view pages containing this malicious content, the injected scripts execute within their browser session.

The exploitation flow involves an attacker injecting crafted input through the comment system, which the vulnerable CommentParser.php processes without proper sanitization. The malicious payload is then stored and rendered to other users, creating a stored XSS condition that persists until the content is removed or the vulnerability is patched.

Detection Methods for CVE-2025-67475

Indicators of Compromise

• Unusual JavaScript execution patterns in browser console logs when viewing wiki comment sections
• Unexpected outbound network requests originating from MediaWiki pages
• User reports of suspicious behavior or unexpected redirects when viewing specific wiki pages
• Anomalous entries in web server access logs containing encoded script payloads in comment-related requests

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect common XSS patterns in requests to MediaWiki endpoints
• Monitor HTTP request parameters for encoded script tags and JavaScript event handlers
• Review CommentParser.php access patterns for unusual POST request volumes
• Deploy browser-based XSS detection mechanisms to identify reflected or stored XSS attempts

Monitoring Recommendations

• Enable verbose logging for MediaWiki's comment processing subsystem
• Configure Content Security Policy (CSP) headers to report and block inline script execution
• Implement real-time alerting for requests containing common XSS payload signatures
• Regularly audit stored wiki content for suspicious script patterns

How to Mitigate CVE-2025-67475

Immediate Actions Required

• Upgrade MediaWiki to the latest patched version: 1.39.16, 1.43.6, 1.44.3, or 1.45.1 depending on your release branch
• Review recent wiki edits and comments for suspicious content
• Implement Content Security Policy headers to mitigate XSS impact
• Consider temporarily restricting comment functionality until patches are applied

Patch Information

Wikimedia Foundation has released patched versions addressing this vulnerability. Organizations should upgrade to MediaWiki version 1.39.16, 1.43.6, 1.44.3, or 1.45.1 depending on their current release branch. Detailed patch information and issue tracking is available through the Wikimedia Task T406664.

Workarounds

• Implement strict Content Security Policy headers to prevent inline script execution
• Deploy a Web Application Firewall with XSS filtering rules in front of MediaWiki
• Temporarily disable or restrict access to comment functionality until patching is complete
• Enable output encoding at the web server level as an additional defense layer

# Example Content Security Policy header configuration for Apache
# Add to your MediaWiki virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none';"