SemanticMediaWiki CVE-2026-116892

Exploitation requires the operator to have explicitly enabled the optional extended search engine by setting $wgSearchType = SMW\MediaWiki\Search\ExtendedSearchEngine::class (or the legacy SMWSearch alias); this is NOT a default configuration, so wikis using MediaWiki's default search are not affected on this path. The attacker needs no account, write permission, or stored content - the smw search profile must simply be registered and a query link must exist so ProfileForm::profile_sheet renders the query. The key limiting factor is required user interaction: a visitor must open the attacker-supplied crafted Special:Search URL (reflected, not stored), so there is no automated mass trigger. Impact is bounded to script execution in the wiki origin in the victim's browser; the advisory did not test or confirm session theft or account takeover.

This is a reflected XSS (CWE-79) carrying a moderate CVSS 4.0 score of 5.3, and the real-world risk is genuinely moderate rather than critical. Positive signals: the input CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N - network-reachable, low-complexity, and unauthenticated - and a public PoC reference exists in the GHSA advisory. Dampening signals dominate, however: the vector requires user interaction (UI:P - a victim must open the attacker's crafted URL), impact is limited (VC:L/VI:L, VA:N), and exploitation is gated on a non-default deployment choice (the operator must have enabled the optional extended search engine via $wgSearchType). No EPSS score is provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no claim of active exploitation; the vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-this-cycle priority rather than a drop-everything emergency. Note a data limitation: the GHSA advisory itself states the first affected release, full affected range, and fixed release are 'unknown' and that its validation was a local JSDOM DOM-marker check (not a browser/Chrome test and not a tested session/account impact), whereas the CVE description, EUVD, and the composer package record independently assert the range 3.1.0 to <7.3.1 fixed in 7.3.1 - treat the fixed-version claim as established by the patch commit and package metadata, but the account-level consequence of the XSS remains untested.

On a wiki that has enabled the optional SemanticMediaWiki extended search engine, an unauthenticated attacker places a crafted Special:Search URL (profile=smw) containing an SVG event-handler payload in a link and lures a reader into opening it. ProfileForm::profile_sheet inserts the search query into a <pre> element unescaped via Html::rawElement, so the browser parses the SVG and runs its handler as script in the wiki's origin. A public PoC request shape exists in the GHSA advisory, but it was validated only via a local JSDOM DOM-marker and is not verified as a working browser exploit; the AV:N/AC:L path still requires victim interaction (UI).