{"id":"CVE-2026-116892","kind":"vulnerability","aliases":["CVE-2026-116892"],"related":[],"title":"Semantic MediaWiki: reflected XSS in Special:Search lets attackers run script","description":"SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profile_sheet inserts unescaped into a pre element, executing script in the wiki origin.","summary":"Semantic MediaWiki versions 3.1.0 through 7.3.0 fail to escape the search parameter on the extended Special:Search profile, so a crafted URL with SVG event handlers is reflected into the page. A visitor who opens such a link runs attacker script in the wiki's origin.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki"],"not_affected_if":["version-7.3.1-or-later"],"how_to_check":"- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or in `composer.lock` / `extension.json`\n- Look for the `smw` search profile being enabled on Special:Search","fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later\n- Until upgraded, unknown whether a configuration change blocks the profile","status":"open","published_at":"2026-10-27T11:17:31+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:31:58+00:00","updated_at":"2026-10-27T11:31:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T11:31:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later\n- Until upgraded, unknown whether a configuration change blocks the profile","reach":"internet","title":"Semantic MediaWiki: reflected XSS in Special:Search lets attackers run script","impact":"medium","summary":"Semantic MediaWiki versions 3.1.0 through 7.3.0 fail to escape the search parameter on the extended Special:Search profile, so a crafted URL with SVG event handlers is reflected into the page. A visitor who opens such a link runs attacker script in the wiki's origin.","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker script runs in visitors' browser sessions on the wiki origin","analyst_note":"","how_to_check":"- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or in `composer.lock` / `extension.json`\n- Look for the `smw` search profile being enabled on Special:Search","needs_analyst":false,"not_affected_if":["version-7.3.1-or-later"],"who_is_affected":"Wikis running Semantic MediaWiki from 3.1.0 before 7.3.1 that expose Special:Search with the extended smw profile. Unauthenticated visitors can be targeted by crafted links, so public wikis are the main exposure. Wikis on versions 7.3.1 or later, or without the extension, are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3375,"output_tokens":573,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116892':14A,17A '-2026':13A,16A '3.1.0':29B,74C '7.3.0':31B '7.3.1':76C 'allow':86C 'attack':9A,65B,88C,102C 'contain':77C 'craft':46B,106C 'cross':81C 'cross-sit':80C 'cve':12A,15A 'element':125C 'escap':34B 'event':50B,114C 'execut':126C 'extend':40B,98C 'fail':32B 'handler':51B,115C 'host':22B 'inject':90C 'insert':120C 'let':8A 'link':63B 'markup':91C 'mediawiki':2A,18B,25B,27B 'open':60B 'origin':71B,131C 'packag':19B 'page':56B 'paramet':37B,95C 'pre':124C 'profil':43B,101C,111C,118C 'profileform':117C 'reflect':3A,53B,79C 'run':10A,64B 'script':11A,66B,83C,127C 'search':7A,36B,42B,94C,100C 'self':21B 'self-host':20B 'semant':1A,24B,26B 'semantic-mediawiki':23B 'semanticmediawiki':72C 'send':104C 'sheet':119C 'site':82C 'smw':110C 'special':6A,41B,99C 'svg':49B,113C 'unauthent':87C 'unescap':121C 'url':47B,107C 'use':108C 'version':28B 'visitor':58B,105C 'vulner':84C 'wiki':69B,130C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki from 3.1.0 before 7.3.1 that expose Special:Search with the extended smw profile. Unauthenticated visitors can be targeted by crafted links, so public wikis are the main exposure. Wikis on versions 7.3.1 or later, or without the extension, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116892","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116892","severity":null,"published_at":"2026-10-27T11:17:31+00:00","modified_at":"2026-10-27T11:17:31+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}