CVE-2026-77616
MediumCVSS 6.1Summary
Semantic MediaWiki versions 7.0.0 through 7.1.0 contain a reflected XSS vulnerability in Special:Ask. The 'cursor' parameter is unsigned and fully attacker-controlled; insufficient validation leads to raw HTML injection into the page.
Risk Assessment
An attacker can craft a malicious link that, when clicked by a victim, executes script in their browser on the wiki's origin, potentially leading to session theft or content modification.
Recommendation
Upgrade Semantic MediaWiki to version 7.2.0, which contains the fix.
Other vulnerabilities in Semantic MediaWiki
See all- CVE-2026-77610Medium
Prior to version 7.2.0, query debug output (format=debug or the 'debug' parameter on Special:Ask) in Semantic MediaWiki is assembled as raw HTML without proper output-context encoding, leading to reflected XSS.
- CVE-2026-77609Medium
Prior to version 7.2.0, Semantic MediaWiki's Special:URIResolver redirects to a URL derived from the subpage without validating the target, allowing an open redirect to an off-host destination, potentially embedding credentials.
- CVE-2026-77608Medium
Prior to version 7.2.0, Semantic MediaWiki reflects the 'value' parameter in rendered output and error messaging paths without sufficient output-context encoding, allowing reflected XSS.
- CVE-2026-77607Medium
Prior to version 7.2.0, Semantic MediaWiki inserts the separator (parameter 'sep') verbatim into HTML cell joins, allowing HTML injection and potentially XSS.
- CVE-2026-77606Medium
Prior to version 7.2.0, when headers=plain is set, Semantic MediaWiki emits table header text into <th> via a raw HTML path. User-controlled 'mainlabel' content can become executable HTML.
- CVE-2025-61682High
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.
Original NVD description (English source)
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, `Special:Ask` accepts a `cursor` query parameter for keyset pagination (added in 7.0.0). The token is decoded by `CursorEncoder`, which is an **unsigned** base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the cursor's sort anchor does not match the request's `sort=` / `order=`, `QueryCreator::applyCursorIfRequested()` builds an error message by interpolating the attacker-controlled `sort_prop` / `sort_order` values into a raw string via `Query::addErrors()`. Unlike SMW's message-key errors, this raw string bypasses the message layer's sanitization (`ProcessingErrorMsgHandler::normalizeAndDecodeMessages()` passes a non-key, non-encoded string through unchanged). `ErrorWidget::queryError()` then assembles the errors and passes them to `Html::errorBox()`, whose first argument is emitted as raw HTML. The result is a reflected cross-site scripting vulnerability: a crafted `cursor` token containing markup in `sort_prop` (or `sort_order`) executes script in the victim's browser on the wiki origin. No authentication or special permission is required. The payload is delivered via a crafted link. Version 7.2.0 contains a fix.