---
id: "CVE-2026-116875"
kind: "vulnerability"
aliases: ["CVE-2026-116875"]
title: "SemanticMediaWiki: Special:Ask reflects separator parameters, enabling cross-site scripting"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mediawiki", "package", "php", "self-hosted", "semantic-mediawiki"]
not_affected_if: ["extension-not-installed", "version-outside-range"]
published_at: "2026-10-27T11:17:29+00:00"
first_seen_at: "2026-10-27T11:31:27+00:00"
updated_at: "2026-10-27T11:32:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116875", "first_seen_at": "2026-10-27T11:31:27+00:00"}]
---

# SemanticMediaWiki: Special:Ask reflects separator parameters, enabling cross-site scripting

Semantic MediaWiki's Special:Ask page echoes separator parameters (sep, propsep, valuesep, delim, separator) into list, category, DSV and CSV results without HTML escaping. A crafted link can make a victim's browser run JavaScript on the wiki's origin, which can steal sessions or CSRF tokens.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or the `composer.lock` / `extensions/SemanticMediaWiki` checkout; affected range is `3.0.0` up to but not including `7.3.1`.
- Confirm whether the extension is enabled in `LocalSettings.php` with `wfLoadExtension( 'SemanticMediaWiki' );`.

## Fix

- Upgrade Semantic MediaWiki to `7.3.1` or later.
- Until upgraded, consider blocking or restricting links to Special:Ask with the separator parameters in a reverse proxy, and rotate sessions if exploitation is suspected.

## Timeline

- 2026-10-27T11:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116875

## From the sources

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using request_type=raw or request_type=special_page to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_