CVE-2026-116892: SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profilesheet inserts unescaped into a pre element, executing script in the wiki origin.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running SemanticMediaWiki versions from 3.1.0 up to, but not including, 7.3.1 are affected when visitors can access the extended Special:Search profile using the smw profile.
What does an attacker need to exploit it?
No authentication is required. An attacker needs to persuade a visitor to open a crafted URL that supplies malicious markup in the search parameter while using the smw profile.
What is the impact if exploitation succeeds?
The injected script executes in the wiki's origin. The reported impact includes low confidentiality and integrity impact, with no reported availability impact.
How can I tell whether my deployment is vulnerable?
Check the installed SemanticMediaWiki version and whether the extended Special:Search smw profile is available. Versions earlier than 7.3.1 within the stated affected range should be treated as vulnerable.