CVE-2025-21612
Published: 06 January 2025
Summary
CVE-2025-21612 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21612 is a cross-site scripting (XSS) vulnerability (CWE-79, CWE-80) in the TabberNeue MediaWiki extension, which enables tab creation on wikis. In versions prior to 2.7.2, the TabberTransclude.php file fails to properly escape user-supplied page names during output, allowing an XSS payload embedded in the page name to execute. The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), indicating high severity due to its network accessibility and potential for significant confidentiality impact.
Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with low complexity and no user interaction required (UI:N). By supplying a malicious page name containing an XSS payload, attackers can inject and execute arbitrary JavaScript in the context of users viewing affected wiki pages, potentially leading to high confidentiality impact such as session hijacking or data theft, alongside low integrity and availability effects.
The vulnerability is addressed in TabberNeue version 2.7.2, where escaping was added to prevent payload execution. Relevant GitHub commits (d8c3db4e5935476e496d979fb01f775d3d3282e6 and f229cab099c69006e25d4bad3579954e481dc566) detail the fix, and the security advisory (GHSA-4x6x-8rm8-c37j) provides further guidance on updating the extension.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-0009
Vulnerability details
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed…
more
in 2.7.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS in public-facing MediaWiki extension directly enables remote exploitation of a web application (T1190) with arbitrary JS execution for impacts like session hijacking.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the core issue by requiring filtering/escaping of user-supplied page names prior to output, preventing XSS payload execution in TabberTransclude.php.
Mandates timely remediation of the specific flaw in TabberNeue versions prior to 2.7.2 through patching to the fixed version that adds escaping.
Provides input validation for user-supplied page names to reject or sanitize potential XSS payloads before processing in the MediaWiki extension.