Live › vulnerability › CVE-2026-116888
Go to dashboardUsers with the smw-schemaedit right can save a property group schema whose canonical_name contains script markup. It renders unescaped on Special:Browse, so JavaScript runs in the sessions of anyone who views that page, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running SemanticMediaWiki between 3.2.0 and 7.3.0 where some users hold the smw-schemaedit right. Exposure depends on whether untrusted or semi-trusted accounts can edit schemas, since the payload is stored and fires for every viewer of Special:Browse. Wikis where only administrators edit schemas face lower risk, and wikis without SemanticMediaWiki can skip it.
No product ranges from the sources yet.
7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds script markup, which GroupFormatter renders unescaped in Special:Browse headings, executing JavaScript in viewers' sessions including administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-116888")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.