Semantic MediaWiki CVE-2026-116874

Requires a Semantic MediaWiki installation running default configuration, where the 'send-response' remote-request feature is enabled by default in smwgRemoteReqFeatures (extension.json:1765), exposing the request_type=special_page export path on the public Special:Ask page. The attacker must supply a query that matches zero pages (e.g. [[NonExistentProperty::x]]) to force the SMW_OUTPUT_FILE zero-result fallback that returns the unescaped default parameter, plus p[format]=json and the script payload in p[default]. The decisive limiting factor is required user interaction (UI:P): a victim - ideally an authenticated/privileged wiki user whose session is worth stealing - must follow the attacker-crafted link; no attacker authentication is needed (PR:N). Impact is bounded to what the victim's browser/session can do in the wiki origin. Removing 'send-response' from RemoteReqFeatures is the vendor-stated interim mitigation that disables the vulnerable path.

This is a genuine but moderate-severity issue, not a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:L/VI:L/SC:L/SI:L, score 5.3) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires victim interaction (UI:P) and yields only low-magnitude confidentiality and integrity impact - consistent with a reflected XSS whose damage is scoped to actions performable as the lured victim in the wiki origin. The SSVC signals align: Exploitation=none (no observed in-the-wild activity), Automatable=yes (the attacker deterministically forces the zero-result fallback with a query like [[NonExistentProperty::x]], so the exploit primitive is reliable), Technical Impact=partial. KEV status is not present, so this is not CISA-listed as actively exploited. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quoted. The vuln.today decision label is 'this_month' - an elevated-but-not-urgent priority - which matches the picture of a reliable, reproducible unauthenticated XSS that still depends on social engineering to land. The GHSA advisory publishes a concrete proof-of-concept request with verified source-line references, raising practical risk above a theoretical finding, but SSVC still records no exploitation. Net: a real, patch-worthy priority for any exposed Semantic MediaWiki instance, but the UI:P requirement and low impact magnitudes keep it below critical/mass-exploitation tier.

An unauthenticated attacker crafts a Special:Ask link containing a zero-result query, p[format]=json, request_type=special_page, and a p[default] value holding a <script> payload, then lures a logged-in wiki user (e.g. an admin) to click it. Because the export-format path echoes the unescaped default parameter with no Content-Type header, the browser renders it as HTML and runs the script in the wiki origin, allowing session-cookie theft, CSRF-token exfiltration, and actions performed as the victim. A full proof-of-concept GET request is published in the vendor's GHSA security advisory, and the zero-result condition is attacker-controlled, making the trigger deterministic; AV:N/AC:L with only UI:P required means the sole real barrier is getting the victim to follow the link.