# Semantic MediaWiki Special:FacetedSearch reflected XSS via cstate parameter

Source: https://junglewise.ai/threats/semantic-mediawiki-special-facetedsearch-reflected-xss-via-cstate-15c1ff89  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.1 · Published 2026-09-18

Semantic MediaWiki's faceted search feature fails to properly sanitize user-supplied query parameters before rendering them in HTML. An attacker can craft a malicious link containing specially-crafted search parameters that, when clicked by a user, executes arbitrary JavaScript in the victim's browser with access to the wiki. This could allow an attacker to steal user sessions, modify wiki content, or conduct phishing attacks against wiki users.

Technologies: [mediawiki/semantic-media-wiki (Packagist)](https://junglewise.ai/threats/technologies/mediawiki-semantic-media-wiki), [Semantic MediaWiki](https://junglewise.ai/threats/technologies/semantic-mediawiki). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Semantic MediaWiki](https://junglewise.ai/threats/vendors/semantic-mediawiki).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.1, published 18 September 2026.

**Which products and versions are affected?** mediawiki/semantic-media-wiki (Packagist) >= 4.2.0, <= 7.2.0; Semantic MediaWiki 7.2.0 and later; also present on master branch.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the `Special:FacetedSearch` page, specifically in how the `cstate` (cached state) parameter is handled. The `HtmlBuilder.php` component concatenates user-controlled `cstate` values directly into HTML attribute contexts without HTML-escaping, then injects the resulting fragment into a Mustache template via triple-brace syntax (`{{{hidden}}}`) which bypasses templating escaping. An attacker can bypass the checksum validation (set `csum` to `crc32(q)` or `filtered=1`) and inject a payload like `cstate[0]=x" autofocus onfocus=alert(1) x"` to break out of the `value="..."` attribute and inject arbitrary event handlers. No authentication is required; the victim need only click a crafted link. A partial fix was applied to CVE-2025-10354 which escaped only the `q` parameter, leaving `cstate` vulnerable.

## Affected products

- Semantic MediaWiki Semantic MediaWiki 7.2.0 and later; also present on master branch

## Timeline

- 2026-09-18: disclosed: GHSA-9rcc-pmj8-ffhr published

## Related threats

- [Semantic MediaWiki authorization bypass in edit protection](https://junglewise.ai/threats/cve-2026-126566-semantic-mediawiki-7-3-1-before-7-4-1-contains-an-incorrect)
- [Semantic MediaWiki denial of service in concept expansion](https://junglewise.ai/threats/cve-2026-126565-semantic-mediawiki-3-0-0-before-7-4-1-contains-a-denial-of)
- [Semantic MediaWiki stored XSS in ValueFormatter property label](https://junglewise.ai/threats/cve-2026-126564-semantic-mediawiki-2-5-0-before-7-4-1-contains-a-stored-cross)
- [Semantic MediaWiki uncontrolled recursion in ConceptDescriptionInterpreter](https://junglewise.ai/threats/cve-2026-126562-semantic-mediawiki-3-0-0-before-7-4-1-contains-an-uncontrolled)
- [Semantic MediaWiki missing authorization in page edit protection](https://junglewise.ai/threats/cve-2026-126561-semantic-mediawiki-2-5-0-before-7-4-1-contains-a-missing)