CVE-2026-116875 in SemanticMediaWiki
Summary
by MITRE • 10/27/2026
SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using request_type=raw or request_type=special_page to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within SemanticMediaWiki versions prior to 7.3.1 represents a significant security flaw located specifically within the Special:Ask interface component of the application. This module is designed to allow users to construct and execute complex queries against the wiki's semantic data store, returning results in various formats such as lists, categories, DSV, or CSV. The core technical deficiency lies in how these result printers handle separator parameters, including sep, propsep, valuesep, delim, and separator. Instead of properly encoding these input values for HTML output, the application passes them through directly into the response body without applying necessary HTML escaping mechanisms. This lack of sanitization creates a classic reflected cross-site scripting vector where user-controlled data is rendered as executable content within the browser context of the victim.
From an architectural perspective, this flaw allows unauthenticated attackers to craft malicious URLs that exploit the query parameters embedded in Special:Ask links. By manipulating specific request types such as raw or special_page, an attacker can inject arbitrary JavaScript code into the page response. When a user clicks on such a crafted link while authenticated with valid credentials for the SemanticMediaWiki instance, their browser will execute the injected script within the origin of the wiki application. This execution context is particularly dangerous because it grants the malicious script full access to the session cookies and other authentication tokens associated with that domain, effectively bypassing same-origin policy protections intended to isolate web applications from one another.
The operational impact of this vulnerability extends beyond simple defacement or minor data leakage. Since the attack vector relies on social engineering through crafted links, it is highly effective against users who trust the source of the link or are tricked into clicking it via phishing campaigns. Once executed, the JavaScript payload can perform a variety of malicious actions typical of session hijacking attacks. These include stealing active session identifiers to impersonate the victim, extracting CSRF tokens to forge state-changing requests on behalf of the user, or redirecting the user to external sites controlled by the attacker. The ability to steal sessions allows an adversary to gain persistent access to the wiki without needing valid credentials, potentially leading to unauthorized modification of semantic data, deletion of content, or further exploitation of other vulnerabilities within the platform that require higher privilege levels.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a common cause for cross-site scripting flaws. The specific mechanism here involves failing to encode special characters in query parameters before rendering them in an HTML context, allowing script injection. In terms of the MITRE ATT&CK framework, this behavior maps directly to T1059, specifically sub-techniques related to command and script interpretation through web browsers. It also facilitates T1539, which covers Steal Web Session Cookie attacks, as the primary goal is often to capture session tokens for lateral movement or privilege escalation within the application environment.
Mitigation strategies must prioritize immediate patching of the SemanticMediaWiki installation to version 7.3.1 or later, where these separator parameters are properly sanitized and HTML-escaped before output. For organizations unable to update immediately due to compatibility constraints with other plugins or custom configurations, temporary workarounds should be implemented at the web server level using Web Application Firewall rules that detect and block requests containing script-like patterns in query parameters associated with Special:Ask endpoints. Additionally, implementing strict Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of injected payloads even if they manage to bypass input validation controls. Regular security audits focusing on output encoding practices across all result printers and API endpoints are recommended to prevent similar vulnerabilities in other modules of the application.