Semantic MediaWiki CVE-2025-61682

Requires an account with the MediaWiki 'edit' right to inject the payload via wikitext using the {{#tag:div|class=smw-subtab|data-subtab=...}} construct - this is the specific feature abused, because non-reserved data attributes such as data-subtab are settable from wikitext and ext.smw.js parses data-subtab of any .smw-subtab element as JSON and appends it to innerHTML. Exploitation is limited by: (1) needing edit privileges (open/anonymous-edit wikis lower this barrier, closed wikis raise it to authenticated users), (2) a victim must subsequently view the crafted page for the stored payload to fire, and (3) only affects installs running Semantic MediaWiki 3.1.0 through 6.x (fixed in 7.0.0).

This is a legitimate but moderate-severity stored XSS in the Semantic MediaWiki extension. The vendor CVSS of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) overstates real-world risk in two ways. First, PR:N conflicts with the advisory's own Impact statement, which says exploitation requires 'any user with the edit right' - injection is therefore authenticated (PR:L) on most non-open wikis, not truly unauthenticated. Second, C:H and UI:N are aggressive for a browser-side stored XSS: typical scoring is C:L/I:L, S:C (script executes in the victim's browser under the wiki's origin), and UI:R because a victim must view the crafted page. A publicly available exploit exists (a full PoC and screenshots are in the GHSA advisory), so exploitability is proven and trivial to reproduce, but there is no EPSS score provided and no CISA KEV listing - status: publicly available exploit code exists, not confirmed active exploitation. No SSVC data was provided. Net: real and easily reproducible, worth patching promptly on multi-user wikis, but the effective risk is that of a self-contained privilege-escalation/session-hijack primitive requiring an account with edit rights, not a mass-exploitable unauthenticated RCE.

An attacker holding edit rights on a Semantic MediaWiki-enabled wiki creates or edits a page containing a {{#tag:div}} with class=smw-subtab and a crafted data-subtab attribute whose decoded JSON value is an HTML string like "<img src='' onerror=alert(1)>". When any other user (including an admin) views the page, ext.smw.js reads the attribute via .dataset and appends it to innerHTML, executing the attacker's JavaScript in the victim's session. A working PoC is published in the GHSA advisory, so weaponization (e.g., session/cookie theft or admin-action forgery) is straightforward.