CVE-2026-116892 in SemanticMediaWiki
Summary
by MITRE • 10/27/2026
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profile_sheet inserts unescaped into a pre element, executing script in the wiki origin.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
SemanticMediaWiki versions ranging from 3.1.0 up to but not including 7.3.1 are susceptible to a reflected cross-site scripting vulnerability within the extended search functionality. This security flaw specifically affects the Special:Search profile feature, which allows users to customize and save their search parameters for future use. The core technical deficiency lies in how the ProfileForm::profile_sheet function handles user-supplied input when rendering the saved profile sheet. Instead of properly sanitizing or encoding special characters within the search parameter data before insertion into the HTML document structure, the application directly embeds this unescaped content into a pre element. This lack of output encoding creates an injection vector that permits malicious actors to execute arbitrary JavaScript code in the context of the victim's browser session and the wiki's origin domain.
The operational impact of this vulnerability is significant because it requires no authentication for exploitation, allowing any internet user with access to the public-facing search interface to launch attacks against other users. An attacker can construct a specially crafted URL that includes malicious SVG markup containing event handlers within the smw profile parameter. When an unsuspecting victim clicks on or loads this link while authenticated to the SemanticMediaWiki instance, their browser will parse and execute the injected script. This execution occurs in the context of the wiki's origin, which means the malicious code inherits all privileges associated with that domain. Consequently, attackers can perform actions such as stealing session cookies, hijacking user sessions, performing unauthorized administrative actions on behalf of the victim, or defacing the website interface by manipulating DOM elements.
From a classification perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves reflected input where user data is immediately returned in an error message or response without adequate validation. In terms of the MITRE ATT&CK framework, this behavior maps to T1059, Command and Scripting Interpreter, specifically through browser-based scripting languages like JavaScript. It also relates to T1204, User Execution, as it relies on social engineering tactics such as sending crafted links via email or instant messaging to trick users into triggering the payload. The use of SVG event handlers is a common technique in modern XSS attacks because many filters may not adequately account for XML-based markup embedded within HTML contexts, allowing script execution even when traditional script tags are blocked by basic input validation rules.
Mitigation strategies should focus on immediate patching and defensive coding practices. Administrators must upgrade SemanticMediaWiki to version 7.3.1 or later where this issue has been resolved through improved output encoding mechanisms. In the interim, if upgrading is not immediately feasible, implementing a Web Application Firewall with robust XSS detection rules can help filter out malicious payloads containing SVG tags and event handlers before they reach the application logic. Developers should also review any custom extensions that interact with search profiles to ensure consistent use of context-aware escaping functions provided by the MediaWiki framework. Regular security audits focusing on input validation and output encoding across all user-facing parameters are essential to prevent similar vulnerabilities in other modules of the platform.