CVE-2026-116891
Received Received - Intake

Reflected XSS in SemanticMediaWiki via Special:FacetedSearch

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116891
EUVD
EUVD-2026-110719

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SemanticMediaWiki SemanticMediaWiki 4.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in SemanticMediaWiki versions 4.2.0 through 7.2.0. It occurs in the Special:FacetedSearch feature due to unescaped 'cstate' parameters. Attackers can craft malicious URLs with parameters like 'q', a matching 'crc32' checksum or 'filtered=1', and a specially crafted 'cstate' value to inject HTML and execute JavaScript in victims' browsers.

Detection Guidance

To detect this vulnerability, inspect SemanticMediaWiki versions between 4.2.0 and 7.2.0 for unescaped 'cstate' parameters in Special:FacetedSearch. Check for malicious URLs containing 'q', 'filtered=1', or a matching 'crc32' checksum with crafted 'cstate' values. Review server logs for requests to Special:FacetedSearch with these parameters.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of users who load a malicious URL. This could lead to session hijacking, theft of sensitive data, or defacement of web pages. Users with administrative privileges are particularly at risk if they access the vulnerable feature.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance violations, legal liabilities, and reputational damage if exploited.

Mitigation Strategies

Upgrade SemanticMediaWiki to version 7.2.1 or later to address the vulnerability. If immediate upgrade is not possible, apply input sanitization to 'cstate' parameters in Special:FacetedSearch. Ensure all user-controlled inputs are properly escaped before rendering in HTML attributes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116891. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart