CVE-2026-116888: SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonicalname. Attackers can save a schema whose canonicalname holds script markup, which GroupFormatter renders unescaped in Special:Browse headings, executing JavaScript in viewers' sessions including administrators.
Affected Software
Event History
Frequently Asked Questions
Which installations should be prioritized for remediation?
SemanticMediaWiki versions from 3.2.0 up to, but not including, 7.3.1 are affected. Installations running 7.3.1 or later are outside the stated affected range.
What level of access does an attacker need?
The attacker needs an account with the smw-schemaedit right. Exploitation also requires a viewer to visit the affected Special:Browse output, where the stored markup is rendered.
Who could be affected when a malicious schema is viewed?
JavaScript can execute in the sessions of users viewing the affected Special:Browse heading, including administrators. The stated impacts include loss of confidentiality and integrity, while availability is not affected.
How can administrators look for possible exploitation?
Review saved property group schemas for canonical_name values containing script markup or other unexpected HTML-like content. Also inspect Special:Browse group headings for unanticipated rendered markup.