CVE-2026-116891 in SemanticMediaWiki
Summary
by MITRE • 10/27/2026
SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within SemanticMediaWiki versions ranging from 4.2.0 up to but not including 7.2.1 represents a significant security flaw classified as an unauthenticated reflected cross-site scripting issue. This defect is located specifically within the Special:FacetedSearch interface, which serves as a primary mechanism for users to query and filter data sets using semantic properties. The root cause of this vulnerability lies in the improper handling of user-supplied input parameters, particularly those associated with the cstate variable. When processing requests directed at the faceted search endpoint, the application fails to adequately sanitize or encode these inputs before rendering them back into the HTML response stream. This lack of proper output encoding allows malicious actors to inject arbitrary script code that is executed by the victim's web browser upon loading the crafted page.
From a technical perspective, the exploitation vector relies on manipulating specific query parameters such as q for search queries and cstate for state management within the faceted search interface. An attacker can construct a URL where the cstate parameter contains malicious JavaScript payloads designed to break out of hidden input attributes embedded in the HTML structure. The vulnerability is further facilitated by the requirement that either the crc32 checksum must match or the filtered flag must be set to one, which ensures the application processes and reflects the user input back into the page context. Because the cstate value is not properly escaped, it can terminate existing HTML tags and inject new script elements directly into the document object model of the victim's browser session. This mechanism allows for the execution of arbitrary client-side code without any form of authentication or prior access privileges.
The operational impact of this vulnerability is severe due to its unauthenticated nature and potential for widespread exploitation via phishing or malicious links. Successful exploitation enables attackers to perform a variety of actions on behalf of the victim, including stealing session cookies that could lead to account takeover, redirecting users to malicious sites designed for credential harvesting, or defacing the application interface. In enterprise environments where SemanticMediaWiki is used for critical knowledge management, such attacks can compromise sensitive data stored within the wiki and erode trust in the platform's security posture. The reflected nature of the XSS means that each attack requires a unique URL crafted by the attacker to be visited by the target, making social engineering tactics essential for successful deployment but also limiting persistent access unless combined with other vulnerabilities or techniques like session fixation.
This vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. It specifically illustrates a failure to validate and encode user input before inclusion in dynamic content generation. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic TA0001 Initial Access under the sub-technique T1189 Drive-by Client Execution or potentially T1566 Phishing if delivered via social engineering links. The attack vector leverages standard web browser behaviors and does not require any client-side software exploits, relying solely on the misconfiguration of input validation within the server-side application logic.
Mitigation strategies must focus on immediate remediation through version upgrades as well as defensive coding practices for developers maintaining older instances that cannot be updated immediately. The primary solution is to upgrade SemanticMediaWiki to version 7.2.1 or later, where this specific reflection flaw has been addressed by implementing robust input sanitization and output encoding mechanisms. For environments unable to patch immediately, web application firewalls can be configured to detect and block requests containing script tags or common XSS payloads within the cstate parameter. Additionally, developers should ensure that all user-supplied data is strictly validated against expected formats and encoded using context-aware escaping techniques before being rendered in HTML attributes or body content. Implementing strict Content Security Policy headers can also mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of injected payloads even if they succeed in reaching the browser.