CVE-2026-116883: Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement() in HtmlBuilder, altering pages and targeting users who view the schema.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated user with the smw-schemaedit permission can exploit it by saving HTML in a schema description. Users are affected when they view the altered schema.
Are anonymous users able to inject the malicious content?
No. Exploitation requires authentication and the smw-schemaedit permission.
What versions are affected?
Semantic MediaWiki versions from 3.1.0 before 7.3.1 are affected.
What should be restricted if an update cannot be applied immediately?
Restrict the smw-schemaedit permission to trusted users, since this permission is required to save the unescaped HTML payload.