Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-77608 EUVD-2026-83173GHSA-59xw-qv23-j3rc

Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Published Sep 18, 2026 · Updated Sep 21, 2026 · Assigned by GitHub_M

Description

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.

Affected products

VendorProductAffectedFixed
SemanticMediaWiki SemanticMediaWiki < 7.2.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist mediawiki/semantic-media-wiki < 7.2.0 7.2.0 GHSA-59xw-qv23-j3rc

References