rootpwn

medium · CVSS v3 6.1

CVE-2026-77606

Semantic MediaWiki prior to version 7.2.0 contains a vulnerability where user-controlled mainlabel content can become executable HTML when h

Overview

Semantic MediaWiki prior to version 7.2.0 contains a vulnerability where user-controlled mainlabel content can become executable HTML when headers=plain. This flaw occurs because table header text is improperly emitted through a raw HTML path. It matters because authenticated or unauthenticated users depending on wiki configuration could inject malicious scripts into wiki pages.

Description

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when `headers=plain`, table header text was emitted into ` ` via a raw HTML path. User-controlled `mainlabel` content could therefore become executable HTML. Version 7.2.0 fixes the issue.

Impact

This vulnerability impacts the integrity and confidentiality of the MediaWiki installation by allowing potential cross-site scripting (XSS) attacks. Attackers could execute arbitrary scripts in the context of a victim's browser session when viewing affected wiki tables. Administrators, editors, and regular wiki users are potentially impacted if they render or view malicious table headers. The overall CVSS v3 score is 6.1 medium severity.

Remediation

Upgrade Semantic MediaWiki to version 7.2.0 or higher to resolve the raw HTML emission issue. Ensure that strict content security policies (CSP) are enforced to limit the potential impact of any injected scripts. Audit existing wiki pages and queries for anomalous mainlabel configurations or unexpected HTML tags.

Risk context

The vulnerability is rated as medium severity with a CVSS v3 score of 6.1. EPSS data is not currently available for this CVE. Organizations utilizing Semantic MediaWiki should prioritize updating during the next maintenance window.

Affected products

  • Semantic MediaWiki Semantic MediaWiki < 7.2.0

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
6.1
CVSS v4
—
EPSS
—

XSS Semantic MediaWiki MediaWiki HTML Injection Web Security Input Validation

← All CVEs

Related CVEs

medium

CVE-2026-77875

A vulnerability exists in the application where sensitive vault data and media files stored on shared external storage are not cryptographically bound to the authentication boundary. A local attacker with auxiliary storage access can directly copy the underlying SQLite database and files, completely bypassing the calculator passcode. This matters because it invalidates the primary privacy mechanism expected by users of secure vault applications.

View analysis

medium

CVE-2026-93921

SiYuan up to version 3.8.4 contains an access control vulnerability in the getDynamicIcon endpoint. The flaw allows read-only token holders to bypass restrictions and retrieve sensitive document metadata using template injection.

View analysis

medium

CVE-2026-77820

The WPComplete plugin for WordPress up to version 2.9.9.0 contains a Stored Cross-Site Scripting vulnerability within the 'empty' shortcode attribute. This flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level privileges or higher to inject malicious scripts into pages. The vulnerability exclusively affects the premium version of the plugin and executes whenever a victim views the affected page.

View analysis

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis