CVE-2026-116886: Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse

Q: Which deployments are affected?

Semantic MediaWiki versions from 2.5.0 through versions before 7.3.1 are affected. Version 7.3.1 is not included in the affected range.

Q: What access does an attacker need?

An attacker needs page-edit rights to store a malicious value in an External identifier property. The payload executes when someone views it through Special:Browse.

Q: Who could be impacted by a stored payload?

Any user who views the affected content in Special:Browse could have JavaScript executed in their session. This includes administrators.

Published Oct 27, 2026

Updated

Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Browse, executing JavaScript in viewers' sessions, including administrators.

Affected Software

1 affected component

Semantic MediaWiki Semantic MediaWiki>=2.5.0<7.3.1

Event History

Oct 27, 2026

CVE Published

via MITRE·10:23 AM

Data Sourced

via MITRE·10:23 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Semantic MediaWiki versions from 2.5.0 through versions before 7.3.1 are affected. Version 7.3.1 is not included in the affected range.

What access does an attacker need?

An attacker needs page-edit rights to store a malicious value in an External identifier property. The payload executes when someone views it through Special:Browse.

Who could be impacted by a stored payload?