CVE-2026-77616

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, `Special:Ask` accepts a `cursor` query parameter for keyset pagination (added in 7.0.0). The token is decoded by `CursorEncoder`, which is an **unsigned** base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the cursor's sort anchor does not match the request's `sort=` / `order=`, `QueryCreator::applyCursorIfRequested()` builds an error message by interpolating the attacker-controlled `sort_prop` / `sort_order` values into a raw string via `Query::addErrors()`. Unlike SMW's message-key errors, this raw string bypasses the message layer's sanitization (`ProcessingErrorMsgHandler::normalizeAndDecodeMessages()` passes a non-key, non-encoded string through unchanged). `ErrorWidget::queryError()` then assembles the errors and passes them to `Html::errorBox()`, whose first argument is emitted as raw HTML. The result is a reflected cross-site scripting vulnerability: a crafted `cursor` token containing markup in `sort_prop` (or `sort_order`) executes script in the victim's browser on the wiki origin. No authentication or special permission is required. The payload is delivered via a crafted link. Version 7.2.0 contains a fix.

• CWE-79

• https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.2.0
• https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-cx86-7xwp-w9wf

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77609Semantic MediaWiki is a free, open-source extension to Media…6.1
• CVE-2026-7761The Ultimate Member plugin for WordPress is vulnerable to Ac…8.8
• CVE-2026-77610Semantic MediaWiki is a free, open-source extension to Media…6.1
• CVE-2026-77611SeaweedFS is a distributed storage system for files and blob…7.1
• CVE-2026-77614Opencast is a free, open-source platform to support the mana…8.8
• CVE-2026-77615Paella Player is a set of libraries to create a multi stream…8.7
• CVE-2026-77619Vector is a high-performance observability data pipeline. Fr…8.7
• CVE-2026-7762A heap-based buffer overflow vulnerability in the dot11ah.ko…9.8
• CVE-2026-77620Vector is a high-performance observability data pipeline. Fr…8.7
• CVE-2026-77621Vector is a high-performance observability data pipeline. Fr…9.3
• CVE-2026-7763A heap-based buffer overflow vulnerability in the morse.ko H…9.8
• CVE-2026-77633Cloudreve is a self-hosted file management and sharing syste…7.1