CVE-2026-116891 SemanticMediaWiki CVE debrief

Who should care

Defenders of Semantic MediaWiki deployments, especially those using version 7.2.0 or earlier, should assess exposure and prioritize verification and remediation. They should review and adjust Special:FacetedSearch input validation and output encoding, monitor for suspicious requests, and verify the effectiveness of existing security controls. Security teams and vulnerability management teams should track exceptions, retest remediated assets, and close the

Why it matters

Reflected XSS in Semantic MediaWiki's Special:FacetedSearch due to unescaped cstate hidden inputs. Defenders should verify exposure, prioritize remediation, and monitor for suspicious activity.

• Verify and patch vulnerable Semantic MediaWiki instances to prevent reflected XSS attacks
• Monitor Special:FacetedSearch requests for suspicious activity
• Adjust input validation and output encoding for Special:FacetedSearch

Technical summary

The vulnerability is caused by unescaped user-controlled input in the cstate hidden inputs of Special:FacetedSearch, which can lead to reflected XSS attacks. The vulnerable code is located in src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php:131-133 and templates/FacetedSearch/search.mustache:25. The issue was confirmed in Semantic MediaWiki version 7.2.0 and the default branch at HEAD 18f418b4cdf2875e67a741349179a22c1573f61c. Defenders should prioritize verifying exposure in Semantic MediaWiki deployments, especially those using version 7.2.0 or earlier.

Defensive priority

Defenders should prioritize verifying exposure in Semantic MediaWiki deployments, especially those using version 7.2.0 or earlier, and assess the effectiveness of existing security controls.

Recommended defensive actions

• Verify Semantic MediaWiki version and apply patch 7.2.1 if vulnerable
• Review and adjust Special:FacetedSearch input validation and output encoding
• Monitor for suspicious Special:FacetedSearch requests and anomalies
• Confirm whether affected Semantic MediaWiki deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in Semantic MediaWiki version 7.2.0 and the default branch at HEAD 18f418b4cdf2875e67a741349179a22c1573f61c. The vulnerable location is in src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php:131-133 and templates/FacetedSearch/search.mustache:25.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.