Live › vulnerability › CVE-2026-116886
Go to dashboardSemantic MediaWiki versions from 2.5.0 before 7.3.1 render External identifier property values unescaped on Special:Browse. A user with page-edit rights can store a script payload that runs in the browser of anyone who views the page, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki from 2.5.0 up to but not including 7.3.1 are exposed. The attacker needs page-edit rights, so wikis that restrict editing to trusted users have less exposure, but any editor's stored script runs for every viewer, including administrators.
No product ranges from the sources yet.
composer.lock / extensions/SemanticMediaWiki directory.7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Browse, executing JavaScript in viewers' sessions, including administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-116886")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.