CVE-2026-116875

Name of the Vulnerable Software and Affected Versions SemanticMediaWiki versions 3.0.0 through 7.3.0

Description A reflected cross-site scripting issue exists in the 'Special:Ask' page. The application fails to perform HTML escaping on separator parameters when using list, category, DSV, and CSV result printers. Unauthenticated attackers can exploit this by sending crafted links using the request type variable with values raw or special page to execute JavaScript in the wiki's origin. This could lead to the theft of sessions or CSRF tokens. The affected parameters are sep, propsep, valuesep, delim, and separator.

Recommendations Update SemanticMediaWiki to version 7.3.1 or later.