rootpwn

medium · CVSS v3 6.1

CVE-2026-77610

Semantic MediaWiki extension allows storing data in wiki pages. Prior to version 7.2.0, debug output from queries can be reflected as raw HT

Overview

Semantic MediaWiki extension allows storing data in wiki pages. Prior to version 7.2.0, debug output from queries can be reflected as raw HTML, enabling reflected XSS. This affects any MediaWiki site using the extension and allows attackers to inject scripts via anonymous requests.

Description

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, query debug output (`format=debug`, or the `debug` request parameter on `Special:Ask`) is assembled by `SMW\Query\DebugFormatter` and emitted as raw HTML. Several of its sinks apply no output-context encoding, so attacker-controlled query input is reflected into the page without escaping. On `Special:Ask` the resulting string is concatenated into the page and sent through `OutputPage::addHTML`, never through the MediaWiki parser or Sanitizer. No special user right is required; an anonymous request suffices. This is a reflected XSS: the payload is taken from the request and echoed in the same response. Exploitation requires the query condition to target a text/blob-typed property (whose value is re-serialized verbatim); the predefined `_txt` properties (`Text`, etc.) that ship on every install satisfy this, so no attacker-created content is needed. Version 7.2.0 patches the issue.

Impact

Confidentiality: attackers can inject scripts that may exfiltrate data or perform actions on behalf of users. Integrity: the reflected payload can modify page content temporarily. Availability: minimal impact. Defenders: site administrators, developers, and security teams should be aware.

Remediation

Upgrade Semantic MediaWiki to version 7.2.0 or later. Disable or remove the debug output feature if not needed. Ensure that any query debug parameters are sanitized or restricted to privileged users. Monitor logs for unexpected debug output usage.

Risk context

Medium severity, no EPSS data available. Patching is recommended promptly to mitigate the reflected XSS risk.

Affected products

  • MediaWiki Semantic MediaWiki
  • MediaWiki
  • SMW
  • Semantic MediaWiki extension
  • MediaWiki with SMW 7.1.x
  • MediaWiki with SMW 7.0.x

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
6.1
CVSS v4
—
EPSS
—

XSS Reflected Semantic MediaWiki MediaWiki Extension Debug Output Open Source

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-77608

Semantic MediaWiki extension for MediaWiki had a reflected XSS vulnerability due to insufficient output encoding of the 'value' parameter. This flaw could allow attackers to inject malicious scripts into wiki pages or error messages. The issue is fixed in version 7.2.0.

View analysis

medium

CVE-2026-77609

Semantic MediaWiki extension allows open redirect via Special:URIResolver. Attackers can craft subpages that redirect to arbitrary external URLs, enabling phishing. The flaw exists in versions prior to 7.2.0.

View analysis

medium

CVE-2026-77616

Semantic MediaWiki versions 7.0.0 through 7.1.0 contain a reflected XSS flaw in the Special:Ask cursor parameter. An attacker can craft a cursor token that injects arbitrary HTML/JavaScript into the page. The vulnerability is exploitable without authentication and can compromise user sessions on the wiki.

View analysis