CVE-2026-77616

Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions 7.0.0 through 7.1.0

Description A reflected cross-site scripting issue exists in the Special:Ask endpoint. The application accepts a cursor query parameter for keyset pagination, which is decoded by CursorEncoder as an unsigned base64url-encoded JSON blob. This allows an attacker to control the contents of the token. When the cursor's sort anchor does not match the request's sort= or order= parameters, the QueryCreator::applyCursorIfRequested() function creates an error message by interpolating the attacker-controlled sort prop or sort order variables into a raw string via Query::addErrors(). This process bypasses the message layer's sanitization in ProcessingErrorMsgHandler::normalizeAndDecodeMessages(). Subsequently, ErrorWidget::queryError() passes these errors to Html::errorBox(), which renders the first argument as raw HTML. An attacker can deliver a crafted link containing a malicious cursor token to execute arbitrary scripts in the victim's browser on the wiki origin without requiring authentication or special permissions.

Recommendations Update Semantic MediaWiki to version 7.2.0. As a temporary mitigation, restrict or avoid the use of the cursor parameter in the Special:Ask endpoint.