CVE-2026-116887 in Semantic MediaWiki
Summary
by MITRE • 10/27/2026
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payload that executes JavaScript in viewers' sessions, including administrators, to read tokens and perform actions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
Semantic MediaWiki versions prior to 7.3.1 contain a critical stored cross-site scripting vulnerability within the Special:Browse interface. This flaw arises from improper input validation and output encoding mechanisms when rendering Keyword-typed property values. The core technical issue lies in the failure of the application to properly sanitize user-supplied data before it is included in the HTML response sent to clients with page-edit privileges. When an authenticated user annotates a Semantic MediaWiki page by adding a keyword property, the system stores this input directly into its database without applying sufficient escaping protocols for subsequent rendering contexts.
The vulnerability specifically manifests when another user or administrator views the Special:Browse page associated with that annotated content. Because the stored payload is rendered unescaped within the HTML structure of the browse view, any JavaScript code embedded in the keyword property executes immediately upon page load. This execution occurs within the security context of the viewer's session rather than as a separate script origin, which allows for full access to browser cookies, local storage, and active authentication tokens associated with that user account.
The operational impact of this vulnerability is severe due to its stored nature and broad attack surface. Unlike reflected XSS attacks that require tricking users into clicking malicious links, this flaw persists in the database and affects every viewer who accesses the compromised page. Attackers can target high-privilege accounts such as administrators by embedding event-handler payloads within keyword properties. Once executed, these scripts can exfiltrate sensitive session tokens to an attacker-controlled server or perform arbitrary actions on behalf of the victim user. This capability enables unauthorized modifications to wiki content, deletion of pages, changes in configuration settings, and potential escalation of privileges if administrative functions are accessible via client-side JavaScript calls.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored injection where malicious scripts persist on the target server. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, specifically through browser-based scripting environments like JavaScript. It also relates to T1213, Data from Information Repositories, as attackers leverage existing data stores to propagate malicious code without needing external hosting infrastructure for the payload itself.
Mitigation strategies must prioritize immediate patching of Semantic MediaWiki to version 7.3.1 or later where these encoding issues have been addressed by developers. Until patches are applied, administrators should restrict page-edit rights to only those users who absolutely require them, thereby reducing the pool of potential attackers capable of injecting malicious payloads. Additionally implementing strict Content Security Policy headers can help mitigate some effects by restricting script execution sources and preventing data exfiltration via unauthorized network requests. Input validation layers at both the application entry point and database storage level should be reviewed to ensure that all special characters are properly escaped before rendering in HTML contexts, particularly for properties rendered dynamically on browse pages.