Reflected Cross-Site Scripting Vulnerability in Semantic MediaWiki by Semantic MediaWiki
CVE-2026-77616

6.1MEDIUM

Key Information:

Vendor

Semanticmediawiki

Status
Semanticmediawiki
Vendor
CVE Published:
18 September 2026

What is CVE-2026-77616?

In versions 7.0.0 through 7.1.0 of Semantic MediaWiki, a reflected cross-site scripting vulnerability exists due to improper handling of the cursor query parameter in Special:Ask. The cursor, which allows for keyset pagination, can be manipulated by an attacker since it is an unsigned base64url-encoded JSON blob. If the sort parameter of the cursor does not match the request's sort or order, the system constructs an error message that incorporates user-controlled values, bypassing sanitization processes. This unfiltered string is then rendered as raw HTML, allowing for potential script execution in the victim's browser. Users are advised to upgrade to version 7.2.0 or later to mitigate this issue.

Affected Version(s)

SemanticMediaWiki >= 7.0.0, < 7.2.0

References

https://github.com/SemanticMediaWiki/SemanticMediaWiki/se...
x_refsource_CONFIRM
https://github.com/SemanticMediaWiki/SemanticMediaWiki/re...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.