Semantic MediaWiki EUVD-2026-83186

Reflected XSS reachable by anonymous, unauthenticated users against default Semantic MediaWiki installs (<=7.1.0): no special user right, account, or attacker-created wiki content is needed because the predefined _txt properties (e.g. Text) ship on every install and satisfy the required text/blob-typed property condition. The specific trigger is the query debug path - format=debug or the debug request parameter on Special:Ask - whose DebugFormatter sinks (buildHTML, prettifySQL, prettifyExplain) emit attacker-controlled query literals as raw HTML via OutputPage::addHTML, bypassing the MediaWiki parser/Sanitizer. LIMITING factors: exploitation requires user interaction (the victim must open a crafted link), so it is not wormable/self-propagating; the inline {{#ask:|format=debug}} path is NOT vulnerable (output is sanitized in parser context), and the prettifySPARQL sink is unaffected - only the Special:Ask reflected path is exposed.

Signals are internally consistent and point to a genuine-but-moderate risk. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1) matches a textbook reflected XSS: network-reachable, low complexity, no privileges, but requiring victim interaction (clicking/loading a crafted Special:Ask URL) and scope change (script executes in the wiki's origin). No EPSS score, KEV entry, or independent POC-in-the-wild signal was provided, so exploitation status is 'no public exploit identified at time of analysis' - though the GHSA advisory does publish a working payload (Special:Ask?q=[[Text::<script>alert(document.domain)</script>]]&debug=1), which lowers the bar for weaponization even absent a packaged exploit. This is a real, patch-worthy priority for any internet-facing SMW wiki (session/cookie theft, admin account takeover via a trusted-origin script) but not a mass-exploitation emergency: it is UI:R (needs a victim to open the link) and impact is C:L/I:L with no availability effect. No conflicting signals detected; the description ('anonymous request suffices') aligns with PR:N.

An attacker crafts a Special:Ask debug URL embedding a script payload in a text-typed property condition (e.g. q=[[Text::<script>...</script>]]&debug=1) and sends it to a wiki user via phishing/chat/forum. When the victim opens the link, the unescaped DebugFormatter output reflects the payload into the page through OutputPage::addHTML and the script runs in the wiki's origin, enabling session-cookie theft or actions as the victim. A working proof-of-concept request is published in the GHSA advisory, though no in-the-wild exploitation is confirmed.