Semantic MediaWiki CVE-2026-116887

Exploitation requires: (1) a Semantic MediaWiki install (3.0.0 through 7.3.0) with a Keyword-typed property in its default configuration - i.e., no display-format schema/URI configured, which is the branch that returns the raw caption; (2) an actor with ordinary page-edit rights to declare the Keyword property and annotate a payload (on wikis that permit anonymous editing this becomes unauthenticated, but the default is an edit-capable account); and (3) a victim who actively views the Special:Browse page for the annotated subject. Limiting factors that reduce realistic risk: the required viewer interaction (the payload fires only when someone opens that specific Browse page), the page-edit privilege needed to plant it on account-gated wikis, and dependence on the default no-display-format Keyword configuration. Maximum impact (administrative actions) is further gated on a privileged user happening to view the page.

This is a genuine but moderate-priority issue rather than a high-urgency emergency. The CVSS 4.0 base score is 5.3 (Medium), and the vuln.today decision label is 'this_month' - not 'act_now' or 'emergency' - which aligns with a stored XSS that depends on a privileged user viewing a specific page. No EPSS probability and no CISA KEV entry were provided, so there is no signal of widespread or confirmed active exploitation; absence of these is not itself a defect but means mass-exploitation likelihood is unquantified. Against that, a detailed, working proof-of-concept is published in the GHSA vendor advisory (full reproduction steps and rendered output), lowering the barrier to exploitation. The input CVSS 4.0 vector sets PR:N (no privileges) on the assumption of anonymous-edit wikis, whereas the description and advisory state the realistic default requires ordinary page-edit rights - so for a typical account-gated wiki this is better modeled as low-privilege (PR:L); verify which editing policy your wiki runs. UI:P/UI:R applies because a victim must actually view the annotated Special:Browse page. The impact is bounded (C:L/I:L, token/session theft and actions in the viewer's context) rather than direct server compromise, though the advisory notes that if an administrator views the page the primitive could plausibly be leveraged for more damaging actions - described by the vendor as plausible, not demonstrated. Net: real and worth patching this cycle, but not a drop-everything issue absent exploitation evidence.

An attacker with ordinary page-edit rights declares a property of type Keyword and annotates a content page with a short markup payload such as [[Kw::<img src=x onerror=alert(document.domain)>]]. The value is stored verbatim and rendered without HTML escaping on Special:Browse, so when another user - including an administrator - views that subject's Browse page, the script executes in their authenticated wiki session and can read session-scoped tokens and perform actions as that viewer. A step-by-step public PoC with the exact payload and rendered output is published in the GHSA advisory.