CVE-2025-23081: Mediawiki DataTransfer Extension CSRF and XSS Vulnerability
Summary
CVE-2025-23081: Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS). Affects mediawiki/data-transfer across 3 version ranges.
>= 1.39.0, < 1.39.11
>= 1.41.0, < 1.41.3
>= 1.42.0, < 1.42.2
Fixed in 1.39.11, 1.41.3 or 1.42.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Mediawiki DataTransfer Extension is a tool designed to facilitate the transfer of data between different Mediawiki installations. It enhances the functionality of Mediawiki by allowing users to import and export content seamlessly. However, like many web applications, it is susceptible to security vulnerabilities, particularly those that can be exploited through improper input handling and session management.
Vulnerability Detail
The vulnerability identified as CVE-2025-23081 involves Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) within the Mediawiki DataTransfer Extension. This issue arises from inadequate validation of user inputs, allowing attackers to craft malicious requests that can be executed in the context of an authenticated user. The ramifications of this vulnerability include unauthorized actions being performed on behalf of users and the potential for sensitive information to be exposed through XSS attacks. The affected versions include Mediawiki DataTransfer Extension from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, and from 1.42.X before 1.42.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.39.0, < 1.39.111.39.11composer require mediawiki/data-transfer:1.39.11 -
>= 1.41.0, < 1.41.31.41.3composer require mediawiki/data-transfer:1.41.3 -
>= 1.42.0, < 1.42.21.42.2composer require mediawiki/data-transfer:1.42.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement additional validation checks on input fields to mitigate the risk of CSRF and XSS attacks. However, this is not a substitute for applying the official patch.
Conclusion
In summary, CVE-2025-23081 poses significant security risks to users of the Mediawiki DataTransfer Extension. It is crucial to update to the latest patched versions to mitigate these vulnerabilities and ensure the safety of your application.
See every vulnerability recorded for mediawiki/data-transfer →
FAQ
CVE-2025-23081 is a vulnerability in the Mediawiki DataTransfer Extension that allows for Cross-Site Request Forgery and Cross-Site Scripting attacks.
If you are using Mediawiki DataTransfer Extension versions prior to 1.39.11, 1.41.3, or 1.42.2, your installation is vulnerable.
The risks include unauthorized actions being performed on behalf of users and potential exposure of sensitive information through XSS.
Yes, tools like Vulert can monitor your application for open-source vulnerabilities in real-time using the composer.lock file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
