{"id":"CVE-2026-116891","aliases":["EUVD-2026-110719","GHSA-8x9p-9f27-hxfj","GHSA-9rcc-pmj8-ffhr"],"status":"published","title":"SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate","description":"SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00174,"percentile":0.06932,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-09-18T16:59:16Z","modified":"2026-11-04T16:09:49Z","fixes":[{"ecosystem":"Packagist","package":"mediawiki/semantic-media-wiki","fixed_in":["7.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"mediawiki/semantic-media-wiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"last_affected":"7.2.0"},{"fixed":"7.2.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"mediawiki/semantic-media-wiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"7.2.1"}]}],"versions":["4.2.0","5.0.0","5.0.1","5.0.2","5.1.0","6.0.0","6.0.1","7.0.0","7.1.0","7.2.0"]}],"products":[{"vendor":"semantic-mediawiki","product":"semantic_mediawiki"},{"vendor":"semanticmediawiki","product":"semanticmediawiki"}],"references":[{"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9rcc-pmj8-ffhr","tags":["vendor-advisory","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/semanticmediawiki-4.2.0-before-7.2.1-reflected-xss-via-special-facetedsearch-cstate","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116891","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8x9p-9f27-hxfj"},{"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.2.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9rcc-pmj8-ffhr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116891.json","tags":["advisory"]},{"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-116891","title":"SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate","description":"SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.","status":"published","published":"2026-10-27T10:23:39.863Z","modified":"2026-11-04T16:09:49.973Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-04T17:34:39.974757Z"}],"euvd":[{"id":"EUVD-2026-110719","description":"SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.","status":"published","published":"2026-10-27T10:23:39Z","modified":"2026-11-04T16:09:49Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-04T17:11:50.285046Z"}],"ghsa":[{"id":"GHSA-8x9p-9f27-hxfj","title":"SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability...","description":"SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.","status":"published","published":"2026-10-27T12:30:49Z","modified":"2026-10-27T12:30:55Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:28.758422Z"},{"id":"GHSA-9rcc-pmj8-ffhr","title":"Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)","description":"### Summary\n\nSpecial:FacetedSearch `cstate` hidden inputs enable reflected XSS (residual of CVE-2025-10354)\n\n### Details\n\n#### Affected versions and vulnerable location\n\n- Confirmed present on latest shipped release tag available in the local clone: `SemanticMediaWiki/SemanticMediaWiki@7.2.0`.\n- Confirmed present on default branch `master` at HEAD `18f418b4cdf2875e67a741349179a22c1573f61c`.\n\nVulnerable sink (default-branch representation):\n\n- `src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php:131-133`\n  - Builds `$hidden` by concatenating unescaped request-controlled `cstate[$key]` values into an HTML attribute context (`value=\"...\"`).\n- `templates/FacetedSearch/search.mustache:25`\n  - Inserts the constructed fragment via `{{{hidden}}}` (no HTML escaping at this boundary).\n\n#### Reachability trace (verified from source)\n\n1. HTTP entrypoint:\n   - `GET` to `Special:FacetedSearch` dispatches into `SMW\\MediaWiki\\Specials\\SpecialFacetedSearch::execute()`.\n2. Request decoding boundary:\n   - `SpecialFacetedSearch::execute()` constructs `UrlArgs` from `$request-\u003egetValues()` and calls `ParametersProcessor::checkRequest($request)`.\n3. Checksum gate:\n   - `ParametersProcessor::checkRequest()` clears `cstate` only when `filtered != 1` and `getInt('csum', 0) != crc32(getVal('q', ''))`.\n4. Decoder -\u003e HTML assembly:\n   - `HtmlBuilder::buildHTML()` iterates `foreach ( $urlArgs-\u003egetArray( 'cstate' ) as $key =\u003e $value )` and concatenates each into `$hidden` without escaping.\n   - `HtmlBuilder::buildHTML()` passes `$hidden` into the template variable `hidden`.\n5. HTML injection sink:\n   - `templates/FacetedSearch/search.mustache` renders `{{{hidden}}}` into the `\u003cform\u003e`, so the concatenated markup is inserted as raw HTML.\n\n### PoC\n\n#### Reproduction steps (source-derived)\n\n1. Choose a `q` value.\n2. Compute `csum` as `crc32(q)`.\n3. Send a request that includes:\n   - `q=\u003cchosen\u003e`\n   - `csum=\u003ccrc32(q)\u003e`\n   - at least one `cstate[\u003ckey\u003e]=\u003cpayload\u003e` entry\n\nExample request shape:\n\n```text\n/index.php/Special:FacetedSearch?q=Text\u0026csum=\u003ccrc32(Text)\u003e\u0026cstate[0]=x%22%20autofocus%20onfocus%3Dalert(1)%20x%22\n```\n\n### Impact\n\n#### Attacker model\n\n- Any remote attacker who can send HTTP requests to `Special:FacetedSearch` (or the localized alias mapped to the same `SpecialFacetedSearch` class) can supply attacker-controlled query parameters.\n- Preconditions:\n  - The attacker must make `cstate` survive `ParametersProcessor::checkRequest()`, either by setting `csum` to `crc32(q)` (when `filtered != 1`), or by setting `filtered=1`.\n  - The attacker must supply `cstate[\u003ckey\u003e]` values containing characters that break out of the HTML `value=\"...\"` attribute context (for example an injected `\"` to terminate the attribute value).\n\n#### Severity and CVSS reasoning\n\nProposed severity: MEDIUM.\n\nProposed CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`.\n\nRationale:\n\n- AV:N: delivered over the network via query parameters.\n- AC:L: requires only setting `q`, `csum`, and at least one `cstate` entry.\n- PR:N: no authentication required for the request path in this code.\n- UI:R: the victim must load the crafted URL.\n- S:C: reflected XSS executes in the wiki origin and can affect other users depending on deployment and browser behavior.\n\n### Why this is a residual of CVE-2025-10354\n\n- The CVE-2025-10354 hardening shipped by escaping the `q` parameter before emitting it into the `value=\"{{q}}\"` attribute.\n- Commit `3d675ce` updates only the `q` rendering to use `htmlspecialchars( $urlArgs-\u003eget( 'q', '' ) )` and does not touch the adjacent `cstate` -\u003e `$hidden` construction loop.\n- As a result, `cstate` remains an unescaped input source that flows into the same raw template injection point (`{{{hidden}}}`), creating a distinct reflected-XSS lane.\n\n### Output (from code inspection)\n\nGiven the payload idea where `cstate[0]` starts with `x\" ... x\"`, `HtmlBuilder.php` constructs the hidden fragment by concatenation:\n\n```html\n\u003cinput name=\"cstate[0]\" type=\"hidden\" value=\"x\" autofocus onfocus=alert(1) x\"\u003e\n```\n\nBecause `search.mustache` injects the fragment via `{{{hidden}}}`, the attacker-controlled markup participates in normal HTML parsing in the response body.\n\n### Suggested fix\n\n- Escape both the `cstate` key and value when constructing `$hidden`.\n- Minimal code change in `src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php`:\n\n```php\nforeach ( $urlArgs-\u003egetArray( 'cstate' ) as $key =\u003e $value ) {\n\t$safeKey = htmlspecialchars( (string)$key, ENT_QUOTES, 'UTF-8' );\n\t$safeValue = htmlspecialchars( (string)$value, ENT_QUOTES, 'UTF-8' );\n\t$hidden .= '\u003cinput name=\"cstate[' . $safeKey . ']\" type=\"hidden\" value=\"' . $safeValue . '\"\u003e';\n}\n```\n\nThis keeps the raw `{{{hidden}}}` template insertion safe by ensuring the concatenated HTML fragment itself is attribute-escaped.\n\n### How I found it and a note on tooling\n\nI anchored on the published CVE-2025-10354 patch by verifying in the checked-out repository that commit `3d675ce` changes only the `q` rendering in `HtmlBuilder.php` to use `htmlspecialchars`.\n\nThen I traced the reachable request path from `SpecialFacetedSearch::execute()` through `ParametersProcessor::checkRequest()` (checksum gate for whether `cstate` survives) into `HtmlBuilder::buildHTML()` where `$hidden` is constructed from `cstate` without escaping and injected into `templates/FacetedSearch/search.mustache` via `{{{hidden}}}`.\n\n(End of file)\n\n### AI tooling\n\nI used AI assistance for the code audit and for drafting this report. I manually verified the finding against the project's source at the location cited above before reporting it, and the severity and impact assessment are my own.","status":"published","published":"2026-09-18T16:59:16Z","modified":"2026-09-18T16:59:20Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:19.455935Z"}],"nvd":[{"id":"CVE-2026-116891","description":"SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.","status":"published","published":"2026-10-27T11:17:31.677Z","modified":"2026-11-04T16:17:43.93Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-04T18:06:23.753671Z"}],"osv":[{"id":"CVE-2026-116891","title":"SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate","description":"SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.","status":"published","published":"2026-10-27T10:23:39.863Z","modified":"2026-11-05T21:15:58.710847607Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T22:01:21.792402Z"},{"id":"GHSA-9rcc-pmj8-ffhr","title":"Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)","description":"### Summary\n\nSpecial:FacetedSearch `cstate` hidden inputs enable reflected XSS (residual of CVE-2025-10354)\n\n### Details\n\n#### Affected versions and vulnerable location\n\n- Confirmed present on latest shipped release tag available in the local clone: `SemanticMediaWiki/SemanticMediaWiki@7.2.0`.\n- Confirmed present on default branch `master` at HEAD `18f418b4cdf2875e67a741349179a22c1573f61c`.\n\nVulnerable sink (default-branch representation):\n\n- `src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php:131-133`\n  - Builds `$hidden` by concatenating unescaped request-controlled `cstate[$key]` values into an HTML attribute context (`value=\"...\"`).\n- `templates/FacetedSearch/search.mustache:25`\n  - Inserts the constructed fragment via `{{{hidden}}}` (no HTML escaping at this boundary).\n\n#### Reachability trace (verified from source)\n\n1. HTTP entrypoint:\n   - `GET` to `Special:FacetedSearch` dispatches into `SMW\\MediaWiki\\Specials\\SpecialFacetedSearch::execute()`.\n2. Request decoding boundary:\n   - `SpecialFacetedSearch::execute()` constructs `UrlArgs` from `$request-\u003egetValues()` and calls `ParametersProcessor::checkRequest($request)`.\n3. Checksum gate:\n   - `ParametersProcessor::checkRequest()` clears `cstate` only when `filtered != 1` and `getInt('csum', 0) != crc32(getVal('q', ''))`.\n4. Decoder -\u003e HTML assembly:\n   - `HtmlBuilder::buildHTML()` iterates `foreach ( $urlArgs-\u003egetArray( 'cstate' ) as $key =\u003e $value )` and concatenates each into `$hidden` without escaping.\n   - `HtmlBuilder::buildHTML()` passes `$hidden` into the template variable `hidden`.\n5. HTML injection sink:\n   - `templates/FacetedSearch/search.mustache` renders `{{{hidden}}}` into the `\u003cform\u003e`, so the concatenated markup is inserted as raw HTML.\n\n### PoC\n\n#### Reproduction steps (source-derived)\n\n1. Choose a `q` value.\n2. Compute `csum` as `crc32(q)`.\n3. Send a request that includes:\n   - `q=\u003cchosen\u003e`\n   - `csum=\u003ccrc32(q)\u003e`\n   - at least one `cstate[\u003ckey\u003e]=\u003cpayload\u003e` entry\n\nExample request shape:\n\n```text\n/index.php/Special:FacetedSearch?q=Text\u0026csum=\u003ccrc32(Text)\u003e\u0026cstate[0]=x%22%20autofocus%20onfocus%3Dalert(1)%20x%22\n```\n\n### Impact\n\n#### Attacker model\n\n- Any remote attacker who can send HTTP requests to `Special:FacetedSearch` (or the localized alias mapped to the same `SpecialFacetedSearch` class) can supply attacker-controlled query parameters.\n- Preconditions:\n  - The attacker must make `cstate` survive `ParametersProcessor::checkRequest()`, either by setting `csum` to `crc32(q)` (when `filtered != 1`), or by setting `filtered=1`.\n  - The attacker must supply `cstate[\u003ckey\u003e]` values containing characters that break out of the HTML `value=\"...\"` attribute context (for example an injected `\"` to terminate the attribute value).\n\n#### Severity and CVSS reasoning\n\nProposed severity: MEDIUM.\n\nProposed CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`.\n\nRationale:\n\n- AV:N: delivered over the network via query parameters.\n- AC:L: requires only setting `q`, `csum`, and at least one `cstate` entry.\n- PR:N: no authentication required for the request path in this code.\n- UI:R: the victim must load the crafted URL.\n- S:C: reflected XSS executes in the wiki origin and can affect other users depending on deployment and browser behavior.\n\n### Why this is a residual of CVE-2025-10354\n\n- The CVE-2025-10354 hardening shipped by escaping the `q` parameter before emitting it into the `value=\"{{q}}\"` attribute.\n- Commit `3d675ce` updates only the `q` rendering to use `htmlspecialchars( $urlArgs-\u003eget( 'q', '' ) )` and does not touch the adjacent `cstate` -\u003e `$hidden` construction loop.\n- As a result, `cstate` remains an unescaped input source that flows into the same raw template injection point (`{{{hidden}}}`), creating a distinct reflected-XSS lane.\n\n### Output (from code inspection)\n\nGiven the payload idea where `cstate[0]` starts with `x\" ... x\"`, `HtmlBuilder.php` constructs the hidden fragment by concatenation:\n\n```html\n\u003cinput name=\"cstate[0]\" type=\"hidden\" value=\"x\" autofocus onfocus=alert(1) x\"\u003e\n```\n\nBecause `search.mustache` injects the fragment via `{{{hidden}}}`, the attacker-controlled markup participates in normal HTML parsing in the response body.\n\n### Suggested fix\n\n- Escape both the `cstate` key and value when constructing `$hidden`.\n- Minimal code change in `src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php`:\n\n```php\nforeach ( $urlArgs-\u003egetArray( 'cstate' ) as $key =\u003e $value ) {\n\t$safeKey = htmlspecialchars( (string)$key, ENT_QUOTES, 'UTF-8' );\n\t$safeValue = htmlspecialchars( (string)$value, ENT_QUOTES, 'UTF-8' );\n\t$hidden .= '\u003cinput name=\"cstate[' . $safeKey . ']\" type=\"hidden\" value=\"' . $safeValue . '\"\u003e';\n}\n```\n\nThis keeps the raw `{{{hidden}}}` template insertion safe by ensuring the concatenated HTML fragment itself is attribute-escaped.\n\n### How I found it and a note on tooling\n\nI anchored on the published CVE-2025-10354 patch by verifying in the checked-out repository that commit `3d675ce` changes only the `q` rendering in `HtmlBuilder.php` to use `htmlspecialchars`.\n\nThen I traced the reachable request path from `SpecialFacetedSearch::execute()` through `ParametersProcessor::checkRequest()` (checksum gate for whether `cstate` survives) into `HtmlBuilder::buildHTML()` where `$hidden` is constructed from `cstate` without escaping and injected into `templates/FacetedSearch/search.mustache` via `{{{hidden}}}`.\n\n(End of file)\n\n### AI tooling\n\nI used AI assistance for the code audit and for drafting this report. I manually verified the finding against the project's source at the location cited above before reporting it, and the severity and impact assessment are my own.","status":"published","published":"2026-09-18T16:59:16Z","modified":"2026-10-28T03:11:07.843706208Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}