{"action":"Upgrade mediawiki/data-transfer to 1.39.11 or later.","affected":[{"fixed":"1.39.11","introduced":"1.39.0"},{"fixed":"1.41.3","introduced":"1.41.0"},{"fixed":"1.42.2","introduced":"1.42.0"}],"component":"mediawiki/data-transfer","cve_ids":["CVE-2025-23081"],"ecosystem":"Packagist","epss":0.00191,"exploited":false,"fixed_versions":["1.39.11","1.41.3","1.42.2"],"ghsa_id":"GHSA-c3h5-h73c-29hq","id":"tcs_01M5KF0GJMH2JSVRX5PMSK8EQC","modified_at":"2025-01-14T20:57:05.830278Z","published_at":"2025-01-14T18:32:00Z","references":["https://osv.dev/vulnerability/GHSA-c3h5-h73c-29hq","https://nvd.nist.gov/vuln/detail/CVE-2025-23081","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1080451","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1093931","https://gerrit.wikimedia.org/r/q/I5e1538a3bf66378810f905834c05626e1d2c82f0","https://gerrit.wikimedia.org/r/q/I773c616db781d2f3f30893ad01ef503bf251a2b3","https://gerrit.wikimedia.org/r/q/I7c9de4c8dcdb3276ba923c6bc7c8eef3531324c7","https://gerrit.wikimedia.org/r/q/I9223c31f02f31f1e06e1a8cddf7d539cc8d3a3d9","https://github.com/wikimedia/mediawiki-extensions-DataTransfer","https://phabricator.wikimedia.org/T379749"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-c3h5-h73c-29hq","url":"https://osv.dev/vulnerability/GHSA-c3h5-h73c-29hq"},{"source":"nvd","source_id":"CVE-2025-23081","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23081"}],"summary":"Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS)"}