CVE-2026-116892GHSA-375v-wx2r-4598
SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile
SemanticMediaWiki SemanticMediaWiki
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 7.3.1SemanticMediaWikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profile_sheet inserts unescaped into a pre element, executing script in the wiki origin.
Text from CVE List
Affected versions 2
- SemanticMediaWikiaffected: 3.1.0 before 7.3.1CVE List
- SemanticMediaWikiunaffected: 7.3.1CVE List
References 3
- github.com/SemanticMediaWiki/SemanticMediaWiki/commit/a77e592320707499769c9386a33d97bc966d9418Fixvia CVE List
- github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-375v-wx2r-4598Advisoryvia CVE List
- vulncheck.com/advisories/semanticmediawiki-3.1.0-before-7.3.1-reflected-xss-via-special-search-smw-profileAdvisoryvia CVE List