CVE-2026-116875: SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters
SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using requesttype=raw or requesttype=specialpage to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
An unauthenticated attacker can craft a malicious Special:Ask URL and send it to a victim. Exploitation requires the victim to open the crafted link; no attacker account or prior access is required.
Which query paths and output formats are affected?
The issue affects Special:Ask requests using request_type=raw or request_type=special_page. The vulnerable separator parameters are rendered by the list, category, DSV, and CSV result printers.
What is the impact if a victim follows a malicious link?
JavaScript can execute in the wiki's origin, allowing an attacker to steal the victim's session or CSRF tokens. The CVSS vector also indicates potential confidentiality and integrity impact, including across a changed security scope.
How can administrators identify potentially vulnerable requests or exposure?
Review Special:Ask usage and logs for requests containing the sep, propsep, valuesep, delim, or separator parameters, particularly when request_type is raw or special_page. Deployments running versions from 3.0.0 before 7.3.1 are affected.