{"id":"CVE-2026-116882","kind":"vulnerability","aliases":["CVE-2026-116882"],"related":[],"title":"Semantic MediaWiki: stored XSS via FacetedSearch exploration-link labels","description":"Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML() passes unescaped to Html::rawElement(), altering the Special:FacetedSearch page and potentially running scripts in viewers' browsers.","summary":"Semantic MediaWiki stores unescaped HTML in FacetedSearch exploration-link labels, which ExploreListBuilder::buildHTML() renders without escaping on Special:FacetedSearch. An authenticated profile or schema editor can inject scripts that run in the browsers of other wiki viewers.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki"],"not_affected_if":["no-facetedsearch","version-7.3.1-or-later"],"how_to_check":"- Check the installed Semantic MediaWiki version in `composer.lock` or Special:Version; affected range is 4.2.0 up to but not including 7.3.1\n- Confirm whether the FacetedSearch feature is in use on the wiki","fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later","status":"open","published_at":"2026-10-27T11:17:30+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:32:19+00:00","updated_at":"2026-10-27T11:32:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T11:32:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later\n","reach":"internet","title":"Semantic MediaWiki: stored XSS via FacetedSearch exploration-link labels","impact":"medium","summary":"Semantic MediaWiki stores unescaped HTML in FacetedSearch exploration-link labels, which ExploreListBuilder::buildHTML() renders without escaping on Special:FacetedSearch. An authenticated profile or schema editor can inject scripts that run in the browsers of other wiki viewers.","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Scripts run in other viewers' browsers on the wiki","analyst_note":"","how_to_check":"- Check the installed Semantic MediaWiki version in `composer.lock` or Special:Version; affected range is 4.2.0 up to but not including 7.3.1\n- Confirm whether the FacetedSearch feature is in use on the wiki\n","needs_analyst":false,"not_affected_if":["version-7.3.1-or-later","no-facetedsearch"],"who_is_affected":"Wikis running Semantic MediaWiki between 4.2.0 and 7.3.1 where users with profile or schema editing rights can create exploration-link labels shown on Special:FacetedSearch. Wikis where only trusted editors can edit profiles and schemas carry less risk. Sites that do not use FacetedSearch are unlikely to be exposed through this path.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":3382,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116882':13A,16A '-2026':12A,15A '4.2.0':66C '7.3.1':68C 'allow':78C 'alter':108C 'attack':93C 'authent':46B,79C 'browser':58B,119C 'buildhtml':38B,102C 'contain':69C 'cross':73C 'cross-sit':72C 'cve':11A,14A 'editor':50B,83C 'escap':41B 'explor':8A,33B,90C 'exploration-link':7A,32B,89C 'explorelistbuild':37B,101C 'facetedsearch':6A,31B,44B,88C,111C 'host':21B 'html':29B,86C,106C 'inject':52B,85C 'label':10A,35B,92C,99C 'link':9A,34B,91C 'markup':96C 'mediawiki':2A,17B,24B,26B,64C 'packag':18B 'page':112C 'pass':103C 'potenti':114C 'profil':47B,80C 'rawel':107C 'render':39B 'run':55B,115C 'schema':49B,82C 'script':53B,75C,116C 'self':20B 'self-host':19B 'semant':1A,23B,25B,63C 'semantic-mediawiki':22B 'site':74C 'special':43B,110C 'store':3A,27B,71C,95C 'unescap':28B,104C 'via':5A 'viewer':62B,118C 'vulner':76C 'wiki':61B 'without':40B 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki between 4.2.0 and 7.3.1 where users with profile or schema editing rights can create exploration-link labels shown on Special:FacetedSearch. Wikis where only trusted editors can edit profiles and schemas carry less risk. Sites that do not use FacetedSearch are unlikely to be exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116882","severity":null,"published_at":"2026-10-27T11:17:30+00:00","modified_at":"2026-10-27T11:17:30+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}