Semantic MediaWiki EUVD-2026-110711

Exploitation requires the attacker to hold the smw-schemaedit permission or an equivalent trusted schema-editing role, and a victim user must subsequently view the affected schema page (UI:P). A further limiting factor is that the flaw is confirmed only as stored raw-HTML insertion; escalation to active cross-site scripting additionally requires the deployment to permit an executable HTML context, which the advisory does not claim holds for every deployment. These conditions - a privileged trusted editor, required victim interaction, and deployment-dependent script execution - constrain realistic risk well below an unauthenticated default-config scenario.

This is a moderate-severity stored XSS (CVSS 4.0 base 4.8, Medium) whose real-world risk is tempered by its access requirements. The vector (AV:N/AC:L/AT:N/PR:H/UI:P) shows network reach and low complexity but requires high privileges - the attacker must already hold the smw-schemaedit permission, a trusted schema-editing role - and a victim must view the affected schema page. No EPSS score is provided and the CVE is not on CISA KEV, so there is no signal of widespread or automated exploitation; the vuln.today decision label is 'this_month,' not act_now or emergency, consistent with a privilege-gated, interaction-dependent issue rather than a mass-exploitable flaw. A safe, inert proof of concept is published in the GHSA advisory that confirms raw HTML insertion, but it intentionally does not execute JavaScript, so active script execution depends on the deployment permitting an executable HTML context. On balance this is a real but bounded insider/trusted-editor risk, not a high-urgency internet-wide threat. Note a data conflict to verify: the GHSA source-code assessment states 'no patched release is known from the checked history,' while the multi-source patch field, EUVD (<7.3.1), and composer package data all indicate a fix in 7.3.1 - the advisory's scope was explicitly limited and did not assess releases after 7.3.1-alpha, so confirm the fixed version with the vendor.

A user holding the smw-schemaedit permission saves a schema whose description field contains HTML; the value is copied by SchemaContentFormatter::schema_summary() and passed unescaped to Html::rawElement() in HtmlBuilder, so it is stored as raw paragraph markup. When another user later views that schema page, the attacker-controlled markup renders in their browser, and where the deployment permits an executable HTML context this becomes cross-site scripting against the viewer. A safe PoC in the GHSA advisory confirms the raw-HTML insertion (observed 'POC-PASS' for an inert marker) but does not itself execute JavaScript.