Impact

Special:ManageWiki does not escape interface messages on the columns and help keys on the form descriptor.

Exploiting this on-wiki requires the (editinterface) right.

Patches

All of these must be applied in order to fully fix this vulnerability

• https://github.com/miraheze/ManageWiki/commit/886cc6b94587f1c7387caa26ca9fe612e01836a0.patch
• https://github.com/miraheze/ManageWiki/commit/2ef0f50880d7695ca2874dc8dd515b2b9bbb02e5.patch
• https://github.com/miraheze/ManageWiki/commit/6942e8b2c01dc33c2c41a471f91ef3f6ca726073.patch

Workarounds

None

References

https://issue-tracker.miraheze.org/T11812

For more information

If you have any questions or comments about this advisory:

• Open an issue on our issue tracker
• Email us at security{{@}}miraheze.org