CVE-2026-77607 in Semantic MediaWiki
Summary
by MITRE • 09/18/2026
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `sep` was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
Semantic MediaWiki is a widely utilized open-source extension for the MediaWiki platform that enables users to store structured data and perform complex queries directly within wiki pages. The software serves as a powerful tool for creating knowledge bases, databases, and collaborative information systems where data relationships are explicitly defined. In versions prior to 7.2.0, the application contained a critical input validation flaw related to how it handled separator values during HTML table generation. Specifically, when constructing output tables from query results, the system inserted the specified separator character or string verbatim into the HTML cell join structure without performing adequate sanitization or encoding checks.
This technical deficiency allows for an injection of arbitrary HTML content through the separator parameter. Because the input was treated as raw data rather than being escaped or validated against a whitelist of safe characters, an attacker could manipulate this field to inject malicious scripts or structural HTML elements into the rendered page output. This behavior classifies the vulnerability under CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting (XSS). The flaw essentially bypasses standard content security measures by exploiting the trust relationship between the application and its users, allowing client-side code execution within the context of the victim's browser session.
The operational impact of this vulnerability is significant for any deployment relying on user-generated input or dynamic query parameters. An attacker could craft a malicious URL or form submission that triggers the injection when another user views the resulting page. This can lead to the theft of sensitive information such as session cookies, authentication tokens, or personal data stored within the wiki. Furthermore, it enables phishing attacks where attackers can inject fake login forms or misleading content into legitimate pages, potentially compromising other users who interact with the manipulated interface. In severe cases, this could facilitate persistent defacement of the wiki site if the injected HTML alters page structure permanently through stored XSS vectors.
To mitigate these risks, administrators must ensure that Semantic MediaWiki is upgraded to version 7.2.0 or later where the issue has been resolved by implementing proper input sanitization and output encoding mechanisms. Until an upgrade is feasible, organizations should implement strict access controls to limit who can execute queries with custom separator parameters. Additionally, deploying a Web Application Firewall (WAF) configured to detect and block HTML injection patterns in query strings may provide temporary protection against exploitation attempts aligned with ATT&CK technique T1059 Command and Scripting Interpreter or T1189 Drive-by Compromise depending on the specific attack vector employed by adversaries. Regular security audits and code reviews focusing on input validation practices are recommended to prevent similar vulnerabilities in future development cycles.