CVE-2026-116888 in SemanticMediaWiki
Summary
by MITRE • 10/27/2026
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds script markup, which GroupFormatter renders unescaped in Special:Browse headings, executing JavaScript in viewers' sessions including administrators.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
SemanticMediaWiki versions ranging from 3.2.0 up to but not including version 7.3.1 are affected by a critical stored cross-site scripting vulnerability that stems from improper input validation and output encoding within the schema management subsystem. This flaw specifically targets users who possess the smw-schemaedit right, which is typically granted to content managers or administrators responsible for defining data structures within the wiki environment. The core technical deficiency lies in how the system handles the canonical_name field of a property group schema. When an authenticated user with sufficient privileges creates or modifies a schema, they can inject malicious script markup into this specific attribute without adequate sanitization. Because SemanticMediaWiki stores these schemas persistently in its database backend, the injected payload becomes part of the application's static configuration data rather than transient input, classifying this as a stored cross-site scripting vulnerability rather than a reflected one.
The operational impact is realized when other users or administrators browse wiki pages that utilize property groups defined by the compromised schema. The GroupFormatter component, which is responsible for rendering metadata and structural information in interfaces such as Special:Browse, retrieves the canonical_name from the database and renders it directly into HTML without applying necessary escaping mechanisms. Consequently, any user viewing these pages triggers the execution of the attacker-controlled JavaScript within their browser session context. This behavior allows an attacker to bypass same-origin policies and interact with the application using the privileges of the victim user. Since the vulnerability affects how administrative or high-privilege interfaces display data, it poses a severe risk if viewed by system administrators, potentially leading to complete compromise of the wiki instance through cookie theft, session hijacking, or unauthorized actions performed on behalf of the administrator.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored injection where malicious content is saved and later served to other users without validation. In terms of adversary tactics, this flaw facilitates the ATT&CK technique T1059 Command and Control via Browser-based Execution or potentially T1078 Valid Accounts if used for initial access escalation through social engineering targeting high-privilege accounts. The persistence of the payload in the database schema means that remediation requires not only patching the software but also auditing existing schemas to identify any previously injected malicious canonical_name values that may still be active and posing a risk to current users.
Mitigation strategies must focus on both immediate containment and long-term architectural fixes. Administrators should immediately upgrade SemanticMediaWiki to version 7.3.1 or later, where the output encoding for schema properties has been corrected to ensure all special characters are properly escaped before rendering in HTML contexts. In addition to upgrading, it is imperative to conduct a thorough audit of existing property group schemas within the wiki database to detect and remove any canonical_name fields containing script tags or other executable JavaScript payloads. Implementing strict Content Security Policy headers can also help mitigate the impact by restricting where scripts are allowed to execute, although this serves as a defense-in-depth measure rather than a primary fix for the underlying input validation failure. Regular security reviews of user permissions associated with the smw-schemaedit right should be performed to ensure that only trusted individuals have the ability to modify schema definitions, thereby reducing the attack surface available to potential insiders or compromised accounts.