Live › vulnerability › CVE-2026-116885
Go to dashboardSemantic MediaWiki's Special:SMWAdmin ID lookup echoes the unescaped id parameter back into the page, so a crafted link injects script. An attacker who lures a logged-in smw-admin into opening it can run script in that session and perform privileged actions as that administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki from 3.1.0 up to but not including 7.3.1. Exposure depends on administrators with the smw-admin right being lured into opening a crafted link; the attack needs no account on the wiki itself. Sites on versions outside that range can skip it.
No product ranges from the sources yet.
composer show mediawiki/semantic-media-wiki and compare it against the fixed release7.3.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into opening a crafted lookup link, bypassing the auto-satisfied edit-token check, to execute script and perform privileged actions in the administrator's session.
This page as .md · .json · in your agent: get_signal("CVE-2026-116885")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.