CVE-2026-116885 in Semantic MediaWiki
Summary
by MITRE • 10/27/2026
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into opening a crafted lookup link, bypassing the auto-satisfied edit-token check, to execute script and perform privileged actions in the administrator's session.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within Semantic MediaWiki versions ranging from 3.1.0 up to but not including 7.3.1 represents a significant security flaw classified as a reflected cross-site scripting issue. This specific weakness resides in the Special:SMWAdmin ID lookup functionality, which is designed for administrative tasks related to managing semantic data and wiki configurations. The core technical failure involves an improper neutralization of input within the id parameter used by this lookup feature. Specifically, user-supplied data passed through this parameter is not adequately sanitized or encoded before being reflected back in the HTTP response. This lack of proper output encoding allows malicious actors to inject arbitrary client-side scripts into the web page context viewed by legitimate users.
The operational impact of this vulnerability is particularly severe due to its interaction with authentication and authorization mechanisms. Typically, administrative functions require a valid edit token to prevent cross-site request forgery attacks. However, in this specific implementation, the auto-satisfied nature of the edit-token check for certain lookup operations creates an unintended bypass mechanism. An unauthenticated attacker can craft a malicious URL containing script payloads within the id parameter and lure a Semantic MediaWiki administrator into visiting it. Because the token validation is effectively circumvented or satisfied automatically during the request process, the browser executes the injected scripts with the full privileges of the logged-in administrator session.
This scenario enables attackers to perform privileged actions on behalf of the victim without their knowledge or consent. The consequences can range from defacement and data theft to complete compromise of the wiki infrastructure if the administrative account possesses broad permissions. By exploiting this reflected XSS vector, an attacker can steal session cookies, capture sensitive configuration details, or manipulate the interface to alter semantic properties and categories stored within the database. This aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting, specifically highlighting the failure to validate and sanitize user input before rendering it in a web page.
Furthermore, this vulnerability facilitates unauthorized access through social engineering tactics where an attacker manipulates a privileged user into initiating the malicious request. This behavior is consistent with ATT&CK technique T1059, Command and Scripting Interpreter, as well as T1204, User Execution, since it relies on the victim's interaction to trigger the code execution within their authenticated context. The ability to bypass token checks underscores a critical flaw in session management logic that undermines the integrity of administrative controls.
To mitigate this risk, organizations running affected versions must upgrade immediately to Semantic MediaWiki version 7.3.1 or later where these input validation and output encoding issues have been addressed. In environments where immediate patching is not feasible, administrators should implement strict access control policies limiting who can execute SMWAdmin functions. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking reflected XSS payloads in URL parameters can provide an additional layer of defense. It is also advisable to review server-side configurations to ensure that edit tokens are strictly validated for all administrative actions, preventing the automatic satisfaction logic from being exploited by unauthenticated requests. Regular security audits and code reviews focusing on input handling in admin interfaces will help prevent similar vulnerabilities in future updates.