CVE-2025-10354: Semantic MediaWiki XSS Vulnerability

CVE-2025-10354 Overview

CVE-2025-10354 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Semantic MediaWiki. This vulnerability allows an attacker to execute arbitrary JavaScript code in a victim's browser by sending them a specially crafted malicious URL targeting the /index.php/Speciaal:GefacetteerdZoeken endpoint parameter. Successful exploitation can lead to the theft of sensitive user data, including session cookies, or enable attackers to perform unauthorized actions on behalf of authenticated users.

Critical Impact

Attackers can steal session cookies and sensitive data, hijack user sessions, and perform actions on behalf of victims by exploiting this reflected XSS vulnerability in Semantic MediaWiki.

Affected Products

• Semantic MediaWiki (specific versions not disclosed)

Discovery Timeline

• 2026-04-21 - CVE-2025-10354 published to NVD
• 2026-04-21 - Last updated in NVD database

Technical Details for CVE-2025-10354

Vulnerability Analysis

This reflected XSS vulnerability (CWE-79) exists in Semantic MediaWiki's faceted search functionality. The vulnerable endpoint /index.php/Speciaal:GefacetteerdZoeken fails to properly sanitize user-supplied input before reflecting it back to the browser. When a victim clicks on a malicious link containing JavaScript payload in the URL parameter, the application reflects this unsanitized input directly into the HTML response, causing the victim's browser to execute the attacker-controlled script within the context of the vulnerable application's origin.

The attack requires user interaction—specifically, the victim must click on a malicious URL crafted by the attacker. Once executed, the malicious JavaScript runs with full access to the victim's session context, enabling cookie theft, keylogging, defacement, or redirection to phishing sites.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the Semantic MediaWiki faceted search feature. The application fails to properly sanitize or encode user-controlled input from URL parameters before including it in the HTTP response. This allows attackers to inject arbitrary HTML and JavaScript code that gets executed in the victim's browser.

Attack Vector

The attack is conducted over the network and targets users who access Semantic MediaWiki installations. An attacker crafts a malicious URL containing JavaScript payload within the vulnerable parameter of the /index.php/Speciaal:GefacetteerdZoeken endpoint. The attacker then distributes this URL through phishing emails, social media, or other channels. When a victim clicks the link while authenticated to the MediaWiki instance, the injected script executes in their browser context, potentially compromising their session.

The attack leverages the Dutch-language endpoint name (GefacetteerdZoeken translates to "FacetedSearch"), suggesting the vulnerability may be present in localized versions of the application. See the INCIBE Security Notice: XSS Risk for additional technical details.

Detection Methods for CVE-2025-10354

Indicators of Compromise

• Unusual or obfuscated JavaScript payloads in URL parameters targeting /index.php/Speciaal:GefacetteerdZoeken
• Web server logs showing requests to the faceted search endpoint containing encoded script tags or event handlers
• User reports of unexpected pop-ups, redirects, or session termination after clicking MediaWiki links

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS patterns in URL parameters
• Monitor access logs for requests containing suspicious characters such as <script>, javascript:, onerror=, or URL-encoded equivalents
• Deploy browser-based XSS protection headers and Content Security Policy (CSP) to limit script execution
• Use SentinelOne Singularity Platform to detect browser-based attacks and suspicious JavaScript execution patterns

Monitoring Recommendations

• Enable verbose logging for web application requests, particularly those targeting special pages and search endpoints
• Establish baseline traffic patterns for the faceted search functionality and alert on anomalies
• Monitor for session anomalies that may indicate successful cookie theft, such as sessions used from different geographic locations

How to Mitigate CVE-2025-10354

Immediate Actions Required

• Review and update Semantic MediaWiki to the latest available version that addresses this vulnerability
• Implement strict Content Security Policy (CSP) headers to prevent inline script execution
• Deploy WAF rules to block requests containing XSS payloads in URL parameters
• Educate users about the risks of clicking untrusted links, especially those pointing to internal wiki resources

Patch Information

Refer to the INCIBE Security Notice: XSS Risk for official patch and remediation guidance from the security advisory. Organizations should monitor Semantic MediaWiki's official release channels for security updates addressing this vulnerability.

Workarounds

• Implement Content Security Policy headers with script-src 'self' to prevent execution of inline and external malicious scripts
• Configure input validation at the reverse proxy or WAF level to strip or block potentially malicious characters from URL parameters
• Consider temporarily restricting access to the faceted search functionality (GefacetteerdZoeken) until a patch is applied
• Enable HTTP-only and Secure flags on session cookies to reduce the impact of potential cookie theft

# Example Apache CSP header configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"

# Example nginx CSP configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';" always;