rootpwn

medium · CVSS v3 6.1

CVE-2026-77608

Semantic MediaWiki extension for MediaWiki had a reflected XSS vulnerability due to insufficient output encoding of the 'value' parameter. T

Overview

Semantic MediaWiki extension for MediaWiki had a reflected XSS vulnerability due to insufficient output encoding of the 'value' parameter. This flaw could allow attackers to inject malicious scripts into wiki pages or error messages. The issue is fixed in version 7.2.0.

Description

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.

Impact

Confidentiality: potential data exfiltration via injected scripts. Integrity: attacker could modify displayed content. Availability: not directly impacted. Defenders: administrators of MediaWiki installations using Semantic MediaWiki.

Remediation

Upgrade Semantic MediaWiki to 7.2.0 or later. If upgrade not possible, disable the 'value' parameter or sanitize output manually. Ensure web server is configured to block script execution in wiki output.

Risk context

Medium severity; no EPSS data available; defenders should address promptly but not treat as critical.

Affected products

  • MediaWiki Semantic MediaWiki
  • MediaWiki

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
6.1
CVSS v4
—
EPSS
—

xss semantic-mediawiki mediawiki output-encoding web-application medium-severity

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-77609

Semantic MediaWiki extension allows open redirect via Special:URIResolver. Attackers can craft subpages that redirect to arbitrary external URLs, enabling phishing. The flaw exists in versions prior to 7.2.0.

View analysis

medium

CVE-2026-77610

Semantic MediaWiki extension allows storing data in wiki pages. Prior to version 7.2.0, debug output from queries can be reflected as raw HTML, enabling reflected XSS. This affects any MediaWiki site using the extension and allows attackers to inject scripts via anonymous requests.

View analysis

medium

CVE-2026-77616

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, `Special:Ask` accepts a `cursor` query parameter for keyset pagination (added in 7.0.0). The token is decoded by `CursorEncoder`, which is an **unsigned** base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the cursor's sort anchor does not match the request's `sort=` / `order=`, `QueryCreator::applyCursorIfRequested()` builds an error message by interpolating the attacker-controlled `sort_prop` / `sort_order` values into a raw string via `Query::addErrors()`. Unlike SMW's message-key errors, this raw string bypasses the message layer's sanitization (`ProcessingErrorMsgHandler::normalizeAndDecodeMessages()` passes a non-key, non-encoded string through unchanged). `ErrorWidget::queryError()` then assembles the errors and passes them to `Html::errorBox()`, whose first argument is emitted as raw HTML. The result is a reflected cross-site scripting vulnerability: a crafted `cursor` token containing markup in `sort_prop` (or `sort_order`) executes script in the victim's browser on the wiki origin. No authentication or special permission is required. The payload is delivered via a crafted link. Version 7.2.0 contains a fix.

View analysis