CVE-2026-116891

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.

Summary

Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

Details

Affected versions and vulnerable location

• Confirmed present on latest shipped release tag available in the local clone: SemanticMediaWiki/[email protected].
• Confirmed present on default branch master at HEAD 18f418b4cdf2875e67a741349179a22c1573f61c.

Vulnerable sink (default-branch representation):

• src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php:131-133
  • Builds $hidden by concatenating unescaped request-controlled cstate[$key] values into an HTML attribute context (value="...").
• templates/FacetedSearch/search.mustache:25
  • Inserts the constructed fragment via {{{hidden}}} (no HTML escaping at this boundary).

Reachability trace (verified from source)

1. HTTP entrypoint:
   • GET to Special:FacetedSearch dispatches into SMW\MediaWiki\Specials\SpecialFacetedSearch::execute().
2. Request decoding boundary:
   • SpecialFacetedSearch::execute() constructs UrlArgs from $request->getValues() and calls ParametersProcessor::checkRequest($request).
3. Checksum gate:
   • ParametersProcessor::checkRequest() clears cstate only when filtered != 1 and getInt('csum', 0) != crc32(getVal('q', '')).
4. Decoder -> HTML assembly:
   • HtmlBuilder::buildHTML() iterates foreach ( $urlArgs->getArray( 'cstate' ) as $key => $value ) and concatenates each into $hidden without escaping.
   • HtmlBuilder::buildHTML() passes $hidden into the template variable hidden.
5. HTML injection sink:
   • templates/FacetedSearch/search.mustache renders {{{hidden}}} into the <form>, so the concatenated markup is inserted as raw HTML.

PoC

Reproduction steps (source-derived)

1. Choose a q value.
2. Compute csum as crc32(q).
3. Send a request that includes:
   • q=<chosen>
   • csum=<crc32(q)>
   • at least one cstate[<key>]=<payload> entry

Example request shape:

/index.php/Special:FacetedSearch?q=Text&csum=<crc32(Text)>&cstate[0]=x%22%20autofocus%20onfocus%3Dalert(1)%20x%22

Impact

Attacker model

• Any remote attacker who can send HTTP requests to Special:FacetedSearch (or the localized alias mapped to the same SpecialFacetedSearch class) can supply attacker-controlled query parameters.
• Preconditions:
  • The attacker must make cstate survive ParametersProcessor::checkRequest(), either by setting csum to crc32(q) (when filtered != 1), or by setting filtered=1.
  • The attacker must supply cstate[<key>] values containing characters that break out of the HTML value="..." attribute context (for example an injected " to terminate the attribute value).

Severity and CVSS reasoning

Proposed severity: MEDIUM.

Proposed CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Rationale:

• AV:N: delivered over the network via query parameters.
• AC:L: requires only setting q, csum, and at least one cstate entry.
• PR:N: no authentication required for the request path in this code.
• UI:R: the victim must load the crafted URL.
• S:C: reflected XSS executes in the wiki origin and can affect other users depending on deployment and browser behavior.

Why this is a residual of CVE-2025-10354

• The CVE-2025-10354 hardening shipped by escaping the q parameter before emitting it into the value="{{q}}" attribute.
• Commit 3d675ce updates only the q rendering to use htmlspecialchars( $urlArgs->get( 'q', '' ) ) and does not touch the adjacent cstate -> $hidden construction loop.
• As a result, cstate remains an unescaped input source that flows into the same raw template injection point ({{{hidden}}}), creating a distinct reflected-XSS lane.

Output (from code inspection)

Given the payload idea where cstate[0] starts with x" ... x", HtmlBuilder.php constructs the hidden fragment by concatenation:

<input name="cstate[0]" type="hidden"…

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.

Summary

Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

Details

Affected versions and vulnerable location

• Confirmed present on latest shipped release tag available in the local clone: SemanticMediaWiki/[email protected].
• Confirmed present on default branch master at HEAD 18f418b4cdf2875e67a741349179a22c1573f61c.

Vulnerable sink (default-branch representation):

• src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php:131-133
  • Builds $hidden by concatenating unescaped request-controlled cstate[$key] values into an HTML attribute context (value="...").
• templates/FacetedSearch/search.mustache:25
  • Inserts the constructed fragment via {{{hidden}}} (no HTML escaping at this boundary).

Reachability trace (verified from source)

1. HTTP entrypoint:
   • GET to Special:FacetedSearch dispatches into SMW\MediaWiki\Specials\SpecialFacetedSearch::execute().
2. Request decoding boundary:
   • SpecialFacetedSearch::execute() constructs UrlArgs from $request->getValues() and calls ParametersProcessor::checkRequest($request).
3. Checksum gate:
   • ParametersProcessor::checkRequest() clears cstate only when filtered != 1 and getInt('csum', 0) != crc32(getVal('q', '')).
4. Decoder -> HTML assembly:
   • HtmlBuilder::buildHTML() iterates foreach ( $urlArgs->getArray( 'cstate' ) as $key => $value ) and concatenates each into $hidden without escaping.
   • HtmlBuilder::buildHTML() passes $hidden into the template variable hidden.
5. HTML injection sink:
   • templates/FacetedSearch/search.mustache renders {{{hidden}}} into the <form>, so the concatenated markup is inserted as raw HTML.

PoC

Reproduction steps (source-derived)

1. Choose a q value.
2. Compute csum as crc32(q).
3. Send a request that includes:
   • q=<chosen>
   • csum=<crc32(q)>
   • at least one cstate[<key>]=<payload> entry

Example request shape:

/index.php/Special:FacetedSearch?q=Text&csum=<crc32(Text)>&cstate[0]=x%22%20autofocus%20onfocus%3Dalert(1)%20x%22

Impact

Attacker model

• Any remote attacker who can send HTTP requests to Special:FacetedSearch (or the localized alias mapped to the same SpecialFacetedSearch class) can supply attacker-controlled query parameters.
• Preconditions:
  • The attacker must make cstate survive ParametersProcessor::checkRequest(), either by setting csum to crc32(q) (when filtered != 1), or by setting filtered=1.
  • The attacker must supply cstate[<key>] values containing characters that break out of the HTML value="..." attribute context (for example an injected " to terminate the attribute value).

Severity and CVSS reasoning

Proposed severity: MEDIUM.

Proposed CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Rationale:

• AV:N: delivered over the network via query parameters.
• AC:L: requires only setting q, csum, and at least one cstate entry.
• PR:N: no authentication required for the request path in this code.
• UI:R: the victim must load the crafted URL.
• S:C: reflected XSS executes in the wiki origin and can affect other users depending on deployment and browser behavior.

Why this is a residual of CVE-2025-10354

• The CVE-2025-10354 hardening shipped by escaping the q parameter before emitting it into the value="{{q}}" attribute.
• Commit 3d675ce updates only the q rendering to use htmlspecialchars( $urlArgs->get( 'q', '' ) ) and does not touch the adjacent cstate -> $hidden construction loop.
• As a result, cstate remains an unescaped input source that flows into the same raw template injection point ({{{hidden}}}), creating a distinct reflected-XSS lane.

Output (from code inspection)

Given the payload idea where cstate[0] starts with x" ... x", HtmlBuilder.php constructs the hidden fragment by concatenation:

<input name="cstate[0]" type="hidden"…