{"id":"CVE-2026-116875","kind":"vulnerability","aliases":["CVE-2026-116875"],"related":[],"title":"SemanticMediaWiki: Special:Ask reflects separator parameters, enabling cross-site scripting","description":"SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using request_type=raw or request_type=special_page to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens.","summary":"Semantic MediaWiki's Special:Ask page echoes separator parameters (sep, propsep, valuesep, delim, separator) into list, category, DSV and CSV results without HTML escaping. A crafted link can make a victim's browser run JavaScript on the wiki's origin, which can steal sessions or CSRF tokens.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","php","self-hosted","semantic-mediawiki"],"not_affected_if":["extension-not-installed","version-outside-range"],"how_to_check":"- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or the `composer.lock` / `extensions/SemanticMediaWiki` checkout; affected range is `3.0.0` up to but not including `7.3.1`.\n- Confirm whether the extension is enabled in `LocalSettings.php` with `wfLoadExtension( 'SemanticMediaWiki' );`.","fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later.\n- Until upgraded, consider blocking or restricting links to Special:Ask with the separator parameters in a reverse proxy, and rotate sessions if exploitation is suspected.","status":"open","published_at":"2026-10-27T11:17:29+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:32:07+00:00","updated_at":"2026-10-27T11:32:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T11:32:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later.\n- Until upgraded, consider blocking or restricting links to Special:Ask with the separator parameters in a reverse proxy, and rotate sessions if exploitation is suspected.","reach":"internet","title":"SemanticMediaWiki: Special:Ask reflects separator parameters, enabling cross-site scripting","impact":"medium","summary":"Semantic MediaWiki's Special:Ask page echoes separator parameters (sep, propsep, valuesep, delim, separator) into list, category, DSV and CSV results without HTML escaping. A crafted link can make a victim's browser run JavaScript on the wiki's origin, which can steal sessions or CSRF tokens.","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted","php"],"confidence":0.8,"needs_auth":"no","worst_case":"Victim's session and CSRF tokens stolen via injected JavaScript","analyst_note":"","how_to_check":"- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or the `composer.lock` / `extensions/SemanticMediaWiki` checkout; affected range is `3.0.0` up to but not including `7.3.1`.\n- Confirm whether the extension is enabled in `LocalSettings.php` with `wfLoadExtension( 'SemanticMediaWiki' );`.","needs_analyst":false,"not_affected_if":["version-outside-range","extension-not-installed"],"who_is_affected":"Wikis running Semantic MediaWiki between 3.0.0 and 7.3.1 that expose Special:Ask with list, category, DSV or CSV result printers are exposed. Victims must open a crafted link, so the attack depends on user interaction, though no login is needed to send the link. Wikis not running Semantic MediaWiki in that version range can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":3408,"output_tokens":711,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116875':14A,17A '-2026':13A,16A '3.0.0':76C '7.3.1':78C 'ask':3A,31B,89C,117C 'attack':111C 'browser':59B 'categori':43B,104C 'contain':79C 'craft':52B,115C 'cross':9A,83C 'cross-sit':8A,82C 'csrf':72B,139C 'csv':46B,107C 'cve':12A,15A 'delim':39B,97C 'dsv':44B,105C 'echo':33B 'enabl':7A 'escap':50B,101C 'execut':129C 'host':23B 'html':49B,100C 'javascript':61B,130C 'link':53B,118C 'list':42B,103C 'make':55B 'mediawiki':18B,26B,28B 'origin':66B,135C 'output':91C 'packag':19B 'page':32B,127C 'paramet':6A,35B,93C 'php':20B 'printer':109C 'propsep':37B,95C 'raw':122C 'reflect':4A,81C 'request':120C,124C 'result':47B,108C 'run':60B 'script':11A,85C 'self':22B 'self-host':21B 'semant':25B,27B 'semantic-mediawiki':24B 'semanticmediawiki':1A,74C 'send':113C 'sep':36B,94C 'separ':5A,34B,40B,92C,98C 'session':70B,137C 'site':10A,84C 'special':2A,30B,88C,116C,126C 'steal':69B,136C 'token':73B,140C 'type':121C,125C 'unauthent':110C 'use':119C 'valuesep':38B,96C 'victim':57B,114C 'vulner':86C 'wiki':64B,133C 'without':48B,99C","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki between 3.0.0 and 7.3.1 that expose Special:Ask with list, category, DSV or CSV result printers are exposed. Victims must open a crafted link, so the attack depends on user interaction, though no login is needed to send the link. Wikis not running Semantic MediaWiki in that version range can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116875","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116875","severity":null,"published_at":"2026-10-27T11:17:29+00:00","modified_at":"2026-10-27T11:17:29+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}