CVE-2026-116885: Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into opening a crafted lookup link, bypassing the auto-satisfied edit-token check, to execute script and perform privileged actions in the administrator's session.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Semantic MediaWiki versions from 3.1.0 before 7.3.1 are affected. Exploitation targets an administrator with smw-admin access who opens a crafted Special:SMWAdmin ID lookup link.
What does an attacker need to exploit this issue?
The attacker does not need to be authenticated, but must convince an smw-admin administrator to visit a crafted link. The malicious content is supplied through the unescaped id parameter.
What is the impact if exploitation succeeds?
Script executes in the administrator's session and can perform privileged actions as that administrator. The issue bypasses the auto-satisfied edit-token check.
What can be done if upgrading is not immediately possible?
The provided information does not identify a configuration workaround. Until Semantic MediaWiki is updated to 7.3.1 or later, administrators with smw-admin access should avoid opening untrusted Special:SMWAdmin lookup links.