Live › vulnerability › CVE-2026-116891
Go to dashboardSemanticMediaWiki versions 4.2.0 through 7.2.0 do not escape the cstate parameter on Special:FacetedSearch, so crafted URLs inject HTML. An unauthenticated attacker who gets a victim to open such a link can run script in the victim's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running SemanticMediaWiki from 4.2.0 before 7.2.1 that expose Special:FacetedSearch are exposed. The attack needs a victim to open a crafted link, so public wikis with logged-in editors are the main concern. Wikis on versions outside that range or without the extension can skip it.
No product ranges from the sources yet.
7.2.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.
This page as .md · .json · in your agent: get_signal("CVE-2026-116891")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.