Live › vulnerability › CVE-2026-116883
Go to dashboardSemantic MediaWiki versions from 3.1.0 before 7.3.1 do not escape schema descriptions, so HTML saved by a user with the smw-schemaedit permission is rendered as-is. Other users who view the schema can have script run in their browser, and the page content can be altered.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Sites running Semantic MediaWiki from 3.1.0 up to but not including 7.3.1 that use schema editing. Exposure requires an account with the smw-schemaedit permission to save the HTML, and the risk falls on users who view the affected schema. Sites on 7.3.1 or later are not affected.
No product ranges from the sources yet.
smw-schemaedit permission (unknown how to list them from the sources).7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement() in HtmlBuilder, altering pages and targeting users who view the schema.
This page as .md · .json · in your agent: get_signal("CVE-2026-116883")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.