# CVE-2026-116891: SemanticMediaWiki reflected XSS in Special:FacetedSearch

Source: https://junglewise.ai/threats/cve-2026-116891-semanticmediawiki-from-4-2-0-before-7-2-1-contains-a-reflected  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116891 · Severity: medium · CVSS 6.1 · Published 2026-10-27

SemanticMediaWiki is a semantic search extension for MediaWiki wikis that allows faceted searching of structured content. A reflected cross-site scripting vulnerability in the Special:FacetedSearch feature allows attackers to craft malicious URLs that execute arbitrary JavaScript in victims' browsers when visited, potentially stealing session cookies, wiki content, or performing actions on behalf of the victim.

Technologies: [SemanticMediaWiki](https://junglewise.ai/threats/technologies/semanticmediawiki). Vendors: [SemanticMediaWiki](https://junglewise.ai/threats/vendors/semanticmediawiki).

## Quick answers

**Is CVE-2026-116891 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116891 being exploited in the wild.

**How severe is CVE-2026-116891?** Medium severity, with a CVSS score of 6.1, published 27 October 2026.

**Which products and versions are affected?** SemanticMediaWiki 4.2.0 through 7.2.0.

**Is there a fix for CVE-2026-116891?** Yes: fixed in 7.2.1. Until then: Escape both the cstate key and value using htmlspecialchars() with ENT_QUOTES when constructing the hidden input fragment in HtmlBuilder.php before template injection.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-08-19","note":"GitHub Security Advisory GHSA-9rcc-pmj8-ffhr published"},{"kind":"advisory","at":"2026-10-27","note":"NVD CVE-2026-116891 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116891 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116891?** Check whether you run SemanticMediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.2.1

Escape both the cstate key and value using htmlspecialchars() with ENT_QUOTES when constructing the hidden input fragment in HtmlBuilder.php before template injection.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-08-19","note":"GitHub Security Advisory GHSA-9rcc-pmj8-ffhr published"},{"kind":"advisory","at":"2026-10-27","note":"NVD CVE-2026-116891 published"}]

## Technical details

A reflected XSS vulnerability exists in Special:FacetedSearch's HtmlBuilder.php where cstate array parameters are concatenated into HTML hidden input attributes without HTML entity escaping. An unauthenticated attacker can bypass the parameter checksum validation by setting filtered=1 or providing a valid crc32 hash of the q parameter, then inject payload characters (e.g., quote marks) into cstate values to break out of the HTML attribute context and execute script tags. The vulnerability is a residual of the incomplete CVE-2025-10354 fix which only escaped the q parameter but left cstate unescaped at the same injection point.

## Affected products

- SemanticMediaWiki SemanticMediaWiki 4.2.0 through 7.2.0

## References

- [https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9rcc-pmj8-ffhr](https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9rcc-pmj8-ffhr)
- [https://www.vulncheck.com/advisories/semanticmediawiki-4.2.0-before-7.2.1-reflected-xss-via-special-facetedsearch-cstate](https://www.vulncheck.com/advisories/semanticmediawiki-4.2.0-before-7.2.1-reflected-xss-via-special-facetedsearch-cstate)

## Related threats

- [SemanticMediaWiki reflected XSS in extended search profile](https://junglewise.ai/threats/cve-2026-116892-semanticmediawiki-from-3-1-0-before-7-3-1-contains-a-reflected)
- [SemanticMediaWiki stored cross-site scripting in tooltip module](https://junglewise.ai/threats/cve-2026-116884-semanticmediawiki-from-5-0-0-before-7-3-1-contains-a-stored)
- [SemanticMediaWiki reflected XSS in Special:Ask separator parameters](https://junglewise.ai/threats/cve-2026-116875-semanticmediawiki-from-3-0-0-before-7-3-1-contains-a-reflected)
- [SemanticMediaWiki reflected XSS in JsonResultPrinter](https://junglewise.ai/threats/cve-2026-116874-semanticmediawiki-from-3-1-0-before-7-3-1-contains-a-reflected)