Medium · 6.9 CVE-2025-32080 EUVD-2025-10811GHSA-xmr2-c47x-rm4p

Cross-origin data leak in mobilefrontend via lazy load images

Published Apr 11, 2025 · Updated Apr 11, 2025 · Assigned by wikimedia-foundation

Vendor: The Wikimedia Foundation Product: Mediawiki - Mobile Frontend Extension Category: Web / CMS

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43.

Affected products

Vendor	Product	Affected	Fixed
The Wikimedia Foundation	Mediawiki - Mobile Frontend Extension	1.39 – ≤ 1.43	—

Advisories 1

WID-SEC-2025-0790 MediaWiki Erweiterungen und -Komponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 23, 2025

References

https://phabricator.wikimedia.org/T366402
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MobileFrontend/+/1123392
https://gerrit.wikimedia.org/r/q/Ia5c3be79db37240acbaa630834e430ec3147e61c