Quick answers
- Is CVE-2026-116888 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116888 being exploited in the wild.
- How severe is CVE-2026-116888?
- Medium severity, with a CVSS score of 4.8, published 27 October 2026.
- Which products and versions are affected?
- Semantic MediaWiki SemanticMediaWiki 3.2.0 before 7.3.1.
- Is there a fix for CVE-2026-116888?
- Yes: fixed in 7.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116888 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116888?
- Check whether you run Semantic MediaWiki SemanticMediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 7.3.1
Technical details
A stored cross-site scripting vulnerability in GroupFormatter's rendering of Special:Browse page headings. The vulnerability stems from failure to HTML-escape the canonical_name field from property group schemas before inserting it into page headings via unescaped Mustache templates. An attacker with the smw-schemaedit right can create a schema with a canonical_name containing arbitrary markup (e.g., img/script tags), which is validated only by the permissive pattern ^(.*)$ and stored verbatim, then rendered without sanitization when any user views Special:Browse for pages with member properties of that group.
Affected products
- Semantic MediaWiki SemanticMediaWiki 3.2.0 before 7.3.1
Timeline
- 2026-09-28: disclosed
- 2026-10-27: advisory