Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

mediawiki/data-transfer

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3PackagistPublished

    Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS)

    CVE-2025-23081 · GHSA-c3h5-h73c-29hq

    Affected
    • Packagist mediawiki/data-transfer >= 1.39.0, < 1.39.11; >= 1.41.0, < 1.41.3; >= 1.42.0, < 1.42.2
    Fixed in
    1.39.111.42.21.41.3· Vendor fix available
    Issue
    Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

    Recommended action: Upgrade to 1.42.2, 1.41.3 or 1.39.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →