Semantic MediaWiki CVE-2026-116885

Requires that the target wiki run Semantic MediaWiki (Special:SMWAdmin and its /lookup subpage are enabled by default) and that a logged-in user holding the smw-admin right opens the attacker's crafted link. The attacker needs no account or privileges and no valid CSRF token, because SpecialAdmin::execute overwrites wpEditToken with the current user's own token before validation, so a bare GET link passes the only request-time guard. The chief limiting factor is the privileged-victim requirement (CVSS UI:P): exploitation depends on social-engineering an smw-admin administrator into clicking the link, and the attacker must supply a non-numeric id that matches no stored entity to force the vulnerable empty-references branch. The complete fix is updating to 7.3.1; as an interim measure the vendor advises restricting the smw-admin right to a minimal set of trusted administrators and cautioning them against following untrusted Special:SMWAdmin links, though this does not remove the flaw.

This is a reflected XSS (CWE-79) in Semantic MediaWiki's Special:SMWAdmin ID lookup, scored 5.3 via the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, impacts VC:L/VI:L/VA:N and subsequent SC:L/SI:L). The network vector with no attacker authentication (PR:N) is offset by the required privileged victim interaction (UI:P): exploitation only succeeds when a user holding the smw-admin right is lured into opening the crafted link, which narrows the targetable population to wiki administrators. vuln.today assigns a 'this_month' priority (not act_now/emergency), consistent with a medium-severity, interaction-dependent flaw. No EPSS score is provided, so exploitation-probability cannot be weighed here, and the CVE is not listed in CISA KEV - no public active-exploitation evidence. The GHSA advisory includes a complete proof-of-concept URL, so the trigger is well documented; a public PoC reference exists, but the input does not mark it as confirmed working exploit code. Signals are internally consistent (network-delivered link, privileged click required), so this is a genuine-but-moderate priority: a credible, well-described attack against administrators rather than a widespread unauthenticated-RCE emergency. Note one source conflict on patch state: the GitHub source-code evidence states 'not fixed' at tag 7.3.0, while the EUVD/reporter metadata and the top-level input state the fix landed in 7.3.1 - treat 7.3.1 as the fixed release but verify against the vendor advisory.

An unauthenticated attacker crafts a single GET URL to Special:SMWAdmin/lookup with an id parameter containing HTML markup (e.g. an img tag with an onerror handler) and sends it to a wiki administrator holding the smw-admin right. When the administrator opens the link, the unmatched ID reaches the empty-references branch, the raw id is reflected unescaped into a warning box, and the script executes in the administrator's authenticated same-origin session. A detailed proof-of-concept is published in the GHSA advisory, though the input does not confirm it as working exploit code.