CVE-2026-77608
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.
- Record
CVE-2026-77608- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-83173
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.
- Record
EUVD-2026-83173- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-59xw-qv23-j3rc
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Failure mode
The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding.
Remediation
- The form value is escaped before it is placed back into the input field.
- Derived error messages are also escaped before being rendered into HTML.
Maintenance note
Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.
- Record
GHSA-59xw-qv23-j3rc- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.
- Record
CVE-2026-77608- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.
- Record
CVE-2026-77608- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-59xw-qv23-j3rc
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Failure mode
The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding.
Remediation
- The form value is escaped before it is placed back into the input field.
- Derived error messages are also escaped before being rendered into HTML.
Maintenance note
Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.
- Record
GHSA-59xw-qv23-j3rc- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawiki/semantic-media-wikiPackagist |
through 7.1.0 | 7.2.0 |
mediawiki/semantic-media-wikiPackagist |
before 7.2.0, plus listed versions 1.91.9-RC11.9.0.11.9.0.21.9.1 Show 45 moreShow less1.9.1.11.9.21.9beta12.02.0-RC12.0-RC22.0-RC32.1.02.1.0-RC12.1.12.1.22.1.32.2.02.2.0-RC12.2.12.2.22.2.32.3.02.3.0-RC12.3.12.4.02.4.0-RC12.4.12.4.22.4.32.4.42.4.52.4.62.5.02.5.0-rc.12.5.12.5.22.5.32.5.42.5.52.5.62.5.72.5.83.0.03.0.0-rc.13.0.0-rc.23.0.13.0.23.1.03.1.0-rc.1 |
7.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-77608 is a medium vulnerability (CVSS 6.1) in Semanticmediawiki, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in mediawiki/semantic-media-wiki 7.2.0.
References
github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-59xw-qv23-j3rc
nvd.nist.gov/vuln/detail/CVE-2026-77608
Left out here: 28 versions. The JSON record has them.