Is CVE-2026-77608 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77608 being exploited in the wild.

How severe is CVE-2026-77608?

Medium severity, with a CVSS score of 6.1, published 18 September 2026.

Which products and versions are affected?

mediawiki/semantic-media-wiki (Packagist) <= 7.1.0, ECOSYSTEM:introduced=0,fixed=7.2.0; Semantic MediaWiki <= 7.1.0.

Is there a fix for CVE-2026-77608?

Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77608 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77608?

Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77608: Semantic MediaWiki reflected XSS in SearchByProperty

Q: Is there a fix for CVE-2026-77608?

Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77608 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-77608?

Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77608 · Severity: medium · CVSS 6.1 · Published 2026-09-18

Semantic MediaWiki is a knowledge management extension for MediaWiki that enables structured data storage and querying. The SearchByProperty page contains a reflected cross-site scripting (XSS) vulnerability in the property and value parameters, allowing an attacker to inject and execute arbitrary JavaScript in a victim's browser. An exploit requires tricking a user into clicking a malicious link, potentially leading to session hijacking, credential theft, or defacement of the affected wiki.

Technologies: mediawiki/semantic-media-wiki (Packagist), Semantic MediaWiki. Vendors: Packagist, Semantic MediaWiki.

Quick answers

Is CVE-2026-77608 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77608 being exploited in the wild.
How severe is CVE-2026-77608?: Medium severity, with a CVSS score of 6.1, published 18 September 2026.
Which products and versions are affected?: mediawiki/semantic-media-wiki (Packagist) <= 7.1.0, ECOSYSTEM:introduced=0,fixed=7.2.0; Semantic MediaWiki <= 7.1.0.
Is there a fix for CVE-2026-77608?: Yes. mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77608 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77608?: Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mediawiki/semantic-media-wiki (Packagist): upgrade to 7.2.0 or later
```
composer require mediawiki/semantic-media-wiki:^7.2.0
```

Technical details

The vulnerability is a reflected XSS (CWE-79) in the Special:SearchByProperty page. The `value` parameter (and `property` parameter) are reflected into rendered output and error messaging paths without sufficient output encoding. An attacker crafts a malicious URL with JavaScript payload in the query parameters; when a victim visits the URL, the script executes in their browser context with the privileges of the authenticated wiki user. The attack vector is network-based and requires user interaction (clicking the link). No authentication is required to trigger the payload. The fix, available in version 7.2.0, escapes form values before rendering them in input fields and escapes error messages before rendering into HTML.

Affected products

Semantic MediaWiki Semantic MediaWiki <= 7.1.0

Identifiers

CVE-2026-77608
GHSA-59xw-qv23-j3rc

Timeline

2026-07-18: disclosed
2026-07-18: patched: Version 7.2.0 released
2026-09-18: advisory

References

https://api.github.com/users/krabina

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.