CVE-2024-25109: Miraheze Managewiki

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.

Affected products

• Miraheze Managewiki: before 2024-02-09 (fixed in 2024-02-09)

Published 2024-02-09. Last modified 2026-06-17.