Reflected Cross-Site Scripting Vulnerability in SemanticMediaWiki by Semantic MediaWiki
CVE-2026-116875

5.3MEDIUM

Key Information:

Vendor

Semanticmediawiki

Status
Semanticmediawiki
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116875?

SemanticMediaWiki versions prior to 7.3.1 are susceptible to a reflected cross-site scripting vulnerability found in the Special:Ask feature. This flaw allows unauthenticated attackers to exploit insecurely handled separator parameters like sep, propsep, and others. By crafting malicious links with specific request types, attackers can execute arbitrary JavaScript within the affected wiki's context, potentially compromising user sessions and CSRF tokens, leading to significant security risks.

Affected Version(s)

SemanticMediaWiki 3.0.0 < 7.3.1

SemanticMediaWiki 7.3.1

References

https://github.com/SemanticMediaWiki/SemanticMediaWiki/se...
vendor-advisory
https://www.vulncheck.com/advisories/semanticmediawiki-3....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.