All vulnerabilities
CVE-2026-116891GHSA-9rcc-pmj8-ffhr

SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate

SemanticMediaWiki SemanticMediaWikiPackagistLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in7.2.1Fixed versionCVE List
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

  • 7.2.1SemanticMediaWikiCVE List
  • 7.2.1mediawiki/semantic-media-wiki, PackagistOSVcomposer require "mediawiki/semantic-media-wiki:^7.2.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.

Text from CVE List

Affected versions 13

  • SemanticMediaWikiaffected: 4.2.0 before 7.2.1CVE List
  • SemanticMediaWikiunaffected: 7.2.1CVE List
  • mediawiki/semantic-media-wiki, Packagistfrom 4.2.0, fixed in 7.2.1OSV
  • mediawiki/semantic-media-wiki, Packagist4.2.0OSV
  • mediawiki/semantic-media-wiki, Packagist5.0.0OSV
  • mediawiki/semantic-media-wiki, Packagist5.0.1OSV
  • mediawiki/semantic-media-wiki, Packagist5.0.2OSV
  • mediawiki/semantic-media-wiki, Packagist5.1.0OSV
  • mediawiki/semantic-media-wiki, Packagist6.0.0OSV
  • mediawiki/semantic-media-wiki, Packagist6.0.1OSV
  • mediawiki/semantic-media-wiki, Packagist7.0.0OSV
  • mediawiki/semantic-media-wiki, Packagist7.1.0OSV
  • mediawiki/semantic-media-wiki, Packagist7.2.0OSV

References 2