CVE-2026-116882: Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML() passes unescaped to Html::rawElement(), altering the Special:FacetedSearch page and potentially running scripts in viewers' browsers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can edit profiles or schemas can inject HTML into FacetedSearch exploration-link labels. Exploitation also requires a user to view the affected Special:FacetedSearch page.
Which deployments are affected?
Semantic MediaWiki versions from 4.2.0 up to, but not including, 7.3.1 are affected. The vulnerable path is relevant where FacetedSearch exploration-link labels can be created or modified by authenticated profile or schema editors.
What can be done if upgrading is not immediately possible?
Restrict profile and schema editing privileges to trusted administrators and review existing FacetedSearch exploration-link labels for injected HTML or script content. Removing untrusted markup reduces the risk of stored content executing when users view Special:FacetedSearch.
How can administrators check for exposure or compromise?
Review profiles and schemas that define FacetedSearch exploration links, focusing on label values for HTML markup or scripts. Then view Special:FacetedSearch to determine whether those labels are rendered as raw HTML.