CVE-2026-116891: SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate
SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
SemanticMediaWiki versions from 4.2.0 before 7.2.1 are affected. The vulnerable functionality is the Special:FacetedSearch page.
What does an attacker need to exploit this issue?
An attacker does not need authentication, but must persuade a victim to open a crafted URL. The URL uses q plus either a matching crc32 csum or filtered=1, along with malicious cstate values that escape hidden input attributes.
What is the impact on a successful exploit?
Malicious HTML or script can execute in the victim's browser in the context of the affected site. The supplied severity vector indicates potential confidentiality and integrity impact, with no stated availability impact.
How can I determine whether we are exposed?
Check whether SemanticMediaWiki is installed at a version from 4.2.0 through any release before 7.2.1, and whether Special:FacetedSearch is reachable by users who could be sent attacker-controlled links. Review requests to that page for cstate parameters, particularly when accompanied by q and filtered=1 or csum values.