Semantic MediaWiki CVE-2026-116891

Requires that the Special:FacetedSearch special page (or its localized alias mapping to SpecialFacetedSearch) be reachable on the target wiki. No authentication is required (PR:N), but the attacker must make the cstate parameter survive ParametersProcessor::checkRequest() - either by supplying csum equal to crc32(q) when filtered != 1, or by setting filtered=1 - and must include at least one cstate[<key>] value containing characters (e.g. an injected double-quote) that break out of the hidden input's value="..." attribute context. The key limiting factor is required user interaction (UI:A): a victim must load the attacker-crafted URL for the reflected script to execute; impact is bounded to the victim's browser in the wiki origin (no direct server confidentiality/integrity/availability impact).

This is a reflected XSS (CWE-79) in the Semantic MediaWiki Special:FacetedSearch feature, scored MEDIUM (CVSS 4.0 base 5.1). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) shows a network-delivered, low-complexity, unauthenticated issue (PR:N) that requires victim interaction (UI:A) - the victim must load the attacker-crafted URL. Impact is confined to subsequent-system integrity/confidentiality (SC:L/SI:L), consistent with script executing in the victim's browser rather than compromising the server directly. The vuln.today Decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score in the supplied data, so there is no signal of active or widespread exploitation. A source-derived PoC (reproduction steps and an example request) is published in the GHSA advisory, but it is a PoC reference, not verified working weaponized exploit code. Signals are internally consistent: moderate severity, reliance on user interaction, and a bounded browser-side impact point to a real but non-urgent, patch-this-month priority rather than a high-CVSS/low-real-risk mismatch. Note the advisory frames this as a residual of CVE-2025-10354 - the earlier fix escaped only the 'q' parameter and left the adjacent cstate -> $hidden loop unescaped. EPSS and KEV data were not provided and should be checked before final prioritization.

An attacker crafts a URL to a victim wiki's Special:FacetedSearch containing q, a matching csum=crc32(q) (or filtered=1), and a cstate[key] payload that breaks out of a hidden input's value="..." attribute (e.g. x" autofocus onfocus=alert(1) x"), then lures a wiki user into clicking it. When the victim loads the link, the unescaped cstate value is reflected as raw HTML via the {{{hidden}}} template and executes script in the wiki's origin, enabling session/credential theft or actions as the victim. A source-derived PoC with reproduction steps exists in the GHSA advisory but is not verified as working exploit code.