CVE-2026-116874: SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query and requesttype=specialpage, executing JavaScript in the wiki origin to steal sessions or CSRF tokens.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
SemanticMediaWiki versions from 3.1.0 before 7.3.1 are affected. Exploitation targets the Special:Ask endpoint and requires a zero-result query with request_type=special_page.
Does an attacker need an account or elevated permissions?
No. The issue can be exploited by an unauthenticated attacker, but the attacker must persuade a victim to visit a crafted Special:Ask link.
What could an attacker do if exploitation succeeds?
Injected JavaScript executes in the wiki origin in the victim's browser. This may allow theft of the victim's session or CSRF tokens.
How can I identify a likely exploitation attempt?
Review requests to Special:Ask for crafted query parameters, particularly requests using request_type=special_page together with a zero-result query and a default parameter containing script-like input.