Executive brief
Semantic MediaWiki is a semantic search extension for MediaWiki that allows structured querying of wiki content. A reflected cross-site scripting (XSS) vulnerability in the `sep` parameter of the Special:Ask page allows unauthenticated attackers to inject arbitrary HTML and JavaScript into the page, potentially stealing user session cookies, defacing content, or performing actions on behalf of authenticated users.
Technical details
The vulnerability is a reflected XSS flaw (CWE-79) in the Special:Ask query interface where the table separator (`sep`) parameter is inserted verbatim into generated HTML without sanitization. An attacker can craft a URL with malicious HTML/JavaScript in the `sep` parameter; when a user visits this link, the payload executes in their browser. The vulnerability is reachable without authentication for both normal HTML output and raw request mode (`request_type=raw`). The fix (version 7.2.0) escapes the `sep` parameter in all non-wiki output modes while preserving safe variants like `<br>` tags for legitimate line-break separators.
Affected products
- Semantic MediaWiki Semantic MediaWiki <= 7.1.0
Timeline
- 2026-07-18: disclosed
- 2026-07-18: patched: Version 7.2.0 released
- 2026-09-18: advisory