CVE-2026-126563: Semantic MediaWiki 2.4.0 before 7.4.1 Reflected XSS via Special:Ask Date Format
Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout format (#-F[...]) to execute script in a logged-in victim's browser session.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Semantic MediaWiki installations running versions from 2.4.0 up to, but not including, 7.4.1 are affected. Exploitation targets users who are logged in and can be induced to open a crafted Special:Ask URL.
Does exploitation require an account or special configuration?
No attacker account is required. The attacker needs to craft a Special:Ask request containing HTML markup in a free-format date printout format using the #-F[...] syntax, then convince a logged-in victim to visit it.
What is the practical impact if a victim opens the crafted URL?
The injected script executes in the logged-in victim's browser session. The vulnerability is reflected XSS and can affect confidentiality and integrity in that session.
What version fixes the issue?
Version 7.4.1 fixes the vulnerability. Installations should upgrade from any affected version to 7.4.1 or later.