Packagist/mediawiki/semantic-media-wiki CVE-2026-116891: medium 6.1, EPSS 0.17%

Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

Action: Upgrade mediawiki/semantic-media-wiki to 7.2.1 or later.

composer require mediawiki/semantic-media-wiki:7.2.1

Affected

Fixed versions

Sources

• osv: GHSA-9rcc-pmj8-ffhr
• https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9rcc-pmj8-ffhr
• https://github.com/SemanticMediaWiki/SemanticMediaWiki
• https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.2.1

CVE-2026-116891 · published 2026-09-18T16:59:16Z · modified 2026-10-28T03:11:07.843706208Z · JSON