Executive brief
Semantic MediaWiki's faceted search feature fails to properly sanitize user-supplied query parameters before rendering them in HTML. An attacker can craft a malicious link containing specially-crafted search parameters that, when clicked by a user, executes arbitrary JavaScript in the victim's browser with access to the wiki. This could allow an attacker to steal user sessions, modify wiki content, or conduct phishing attacks against wiki users.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the `Special:FacetedSearch` page, specifically in how the `cstate` (cached state) parameter is handled. The `HtmlBuilder.php` component concatenates user-controlled `cstate` values directly into HTML attribute contexts without HTML-escaping, then injects the resulting fragment into a Mustache template via triple-brace syntax (`{{{hidden}}}`) which bypasses templating escaping. An attacker can bypass the checksum validation (set `csum` to `crc32(q)` or `filtered=1`) and inject a payload like `cstate[0]=x" autofocus onfocus=alert(1) x"` to break out of the `value="..."` attribute and inject arbitrary event handlers. No authentication is required; the victim need only click a crafted link. A partial fix was applied to CVE-2025-10354 which escaped only the `q` parameter, leaving `cstate` vulnerable.
Affected products
- Semantic MediaWiki Semantic MediaWiki 7.2.0 and later; also present on master branch
Timeline
- 2026-09-18: disclosed: GHSA-9rcc-pmj8-ffhr published