MediaWiki Springboard CVE-2025-62696

Exploitation requires that the target MediaWiki installation has the Springboard extension installed and enabled - this is an optional, third-party extension, not MediaWiki core, so the vast majority of MediaWiki sites are unaffected by default. The affected code is the 'master' development branch (no fixed/affected release tag is given), limiting exposure to sites tracking upstream development. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed once the extension is present. The CVE description does not name the specific injectable parameter, endpoint, or configuration flag, so defenders should consult Gerrit change 1174003 and Phabricator T400422 to identify the exact vulnerable input. The primary limiting factor is the requirement that the non-default Springboard extension be deployed and exposed.

Signals point to a moderate, not emergency, priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated command injection, which on its face is serious, but every impact metric is rated Low (VC:L/VI:L/VA:L and subsequent SC:L/SI:L/SA:L), holding the score to 6.9 (Medium). This is notable because CWE-77 command injection typically yields full arbitrary command execution and High impacts - the uniformly Low vendor ratings suggest the injection runs in a constrained or limited context, OR that the scoring is conservative; this conflict should be verified against the Gerrit patch and Phabricator ticket (T400422). EPSS is 1.12% (65th percentile) - modestly above baseline but not indicative of imminent mass exploitation. There is no CISA KEV listing and no public exploit was identified in the provided data, so there is no evidence of active exploitation. Net: a real but contained issue whose priority is driven mainly by the unauthenticated network vector; the Low impact ratings and absence of KEV/POC argue against treating it as a drop-everything item. Note the affected version is 'master' (a development branch), not a tagged release, which further limits real-world exposure.

A remote, unauthenticated attacker sends a crafted request to a MediaWiki instance that has the Springboard extension installed and enabled, embedding shell metacharacters into an input that the extension passes to a system command. The injected command executes on the server in the extension's context. No public proof-of-concept was identified at the time of analysis, so exploitation would require an attacker to derive the injection point from the public Gerrit patch.