Live › vulnerability › CVE-2026-116882
Go to dashboardSemantic MediaWiki stores unescaped HTML in FacetedSearch exploration-link labels, which ExploreListBuilder::buildHTML() renders without escaping on Special:FacetedSearch. An authenticated profile or schema editor can inject scripts that run in the browsers of other wiki viewers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki between 4.2.0 and 7.3.1 where users with profile or schema editing rights can create exploration-link labels shown on Special:FacetedSearch. Wikis where only trusted editors can edit profiles and schemas carry less risk. Sites that do not use FacetedSearch are unlikely to be exposed through this path.
No product ranges from the sources yet.
composer.lock or Special:Version; affected range is 4.2.0 up to but not including 7.3.17.3.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML() passes unescaped to Html::rawElement(), altering the Special:FacetedSearch page and potentially running scripts in viewers' browsers.
This page as .md · .json · in your agent: get_signal("CVE-2026-116882")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.