high · 8.6CVE-2025-61682Sep 18, 2026

CVE-2025-61682: Semantic MediaWiki Stored XSS via data-subtab Attribute

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Any wiki editor can inject and execute arbitrary JavaScript in other users' browsers by embedding a crafted data attribute in wikitext, because Semantic MediaWiki writes that attribute value directly…

Packagemediawiki/semantic-media-wiki
Ecosystemcomposer
Affected>= 3.1.0, < 7.0.0
Fixed in7.0.0

The problem

In res/smw/ext.smw.js, every element carrying the smw-subtab CSS class has its data-subtab attribute read via .dataset and written verbatim to element.innerHTML. MediaWiki does not treat data-subtab as a reserved attribute, so editors can set it freely from wikitext using the #tag parser function.

Anyone with the edit right can therefore persist arbitrary HTML in any page. A visitor who loads the page will execute attacker-controlled JavaScript with no further interaction required. The issue affects all SMW releases from 3.1.0 up to and including 6.x.

Proof of concept

A working proof-of-concept for CVE-2025-61682 in mediawiki/semantic-media-wiki, with the exact payload below.

text
{{#tag:div|
|class=smw-subtab
|data-subtab=""<img src='' onerror=alert(1)>""
}}

MediaWiki HTML-encodes the attribute on save (" becomes &quot;), but the browser decodes it back to a plain double-quote when JavaScript reads element.dataset.subtab. The decoded value is valid JSON ("<img src='' onerror=alert(1)>"), so JSON.parse() succeeds and returns the raw HTML string, which is then assigned to innerHTML, sinking it directly into the DOM and triggering the onerror handler.

The fix in 7.0.0 removes the innerHTML assignment entirely. The patch replaces it with safe DOM construction (using document.createElement and appendChild, or equivalent textContent-only paths), so user-controlled data is never interpreted as markup.

The fix

Upgrade to mediawiki/semantic-media-wiki version 7.0.0 or later. No configuration workaround exists for older versions; the vulnerable code path runs on every page load where an smw-subtab element is present. If an immediate upgrade is not possible, restrict the edit right to fully trusted users as a temporary mitigation.

Reporter not attributed.

References: [1][2][3]

Related research