[ CVE-2026-116874 · Published 27 Oct 2026 ]

Vulnerability in SemanticMediaWiki

CVSS 6.1 EPSS <1%No fix listed yet

[ Description ]Official description

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query and request_type=special_page, executing JavaScript in the wiki origin to steal sessions or CSRF tokens.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-574v-j8hf-88h3ExploitMitigationVendor Advisory
www.vulncheck.com/advisories/semanticmediawiki-3.1.0-before-7.3.1-reflected-xss-via-jso…Third Party Advisory