CVE-2026-77610: 
PHP vulnerability analysis and mitigation

CVE-2026-77610 is a reflected Cross-Site Scripting (XSS) vulnerability in Semantic MediaWiki's query debug output, specifically within the SMW\Query\DebugFormatter class. It affects all versions of the mediawiki/semantic-media-wiki Composer package up to and including 7.1.0, and was originally published on July 18, 2026, with the advisory updated on September 18, 2026. No authentication is required to exploit this vulnerability — anonymous requests suffice. It carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, SMW Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), arising from multiple unencoded output sinks in DebugFormatter. Specifically: buildHTML() echoes the re-serialized ASK query string escaping only [ while allowing <, >, ", and ' to pass through; prettifySQL() returns generated SQL verbatim with only SQL-level quoting (no HTML encoding); and prettifyExplain() echoes raw EXPLAIN output, which on PostgreSQL includes WHERE clause literals. The resulting HTML string is passed directly to OutputPage::addHTML on Special:Ask, bypassing the MediaWiki parser and Sanitizer entirely. Exploitation requires targeting a text/blob-typed property (e.g., the built-in _txt/Text property present on every installation), meaning no attacker-created wiki content is needed — only a crafted URL with a malicious query condition and the debug=1 parameter (Github Advisory, SMW Advisory).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the browser of any user who clicks a crafted link to the vulnerable Special:Ask page. Because the CVSS scope is "Changed," the impact crosses trust boundaries — scripts can access session cookies, authentication tokens, or other sensitive data belonging to the victim user, potentially enabling session hijacking or credential theft. Integrity and confidentiality are both partially compromised (CVSS C:L/I:L), while availability is unaffected. The attack is particularly dangerous on wikis where privileged users (administrators, bureaucrats) may be socially engineered into clicking a malicious link (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, exploitation is trivially simple — it requires only crafting a URL with a malicious query condition and no authentication — making it a low-barrier attack for any network-accessible attacker who can trick a victim into clicking a link (Github Advisory, SMW Advisory).

1. Reconnaissance: Identify MediaWiki installations running the Semantic MediaWiki extension version ≤ 7.1.0 by checking publicly accessible wiki pages, version disclosure in page footers, or the Special:Version page.
2. Craft malicious URL: Construct a URL targeting the Special:Ask page with a debug parameter and an XSS payload embedded in the query condition targeting a text-typed property, e.g.:

   https://example-wiki.org/wiki/Special:Ask?q=[[Text::<script>alert(document.domain)</script>]]&debug=1

3. Deliver the link: Send the crafted URL to a target user (e.g., a wiki administrator) via phishing email, social media, or another social engineering vector.
4. Payload execution: When the victim clicks the link, the DebugFormatter re-serializes the query condition and emits it as raw HTML via OutputPage::addHTML without encoding, causing the browser to execute the injected script in the context of the wiki's origin.
5. Post-exploitation: The executed script can steal session cookies, perform actions on behalf of the victim (e.g., escalate privileges, modify wiki content), or exfiltrate sensitive data to an attacker-controlled server (Github Advisory, SMW Advisory).

• Network: HTTP GET requests to Special:Ask containing debug=1 (or format=debug) combined with query parameters (q=) that include HTML/JavaScript special characters such as <script>, alert(, onerror=, or URL-encoded equivalents (e.g., %3Cscript%3E).
• Logs: Web server access logs showing requests to /wiki/Special:Ask or /index.php?title=Special:Ask with suspicious q= parameter values containing angle brackets, JavaScript event handlers, or encoded XSS payloads alongside debug=1.
• Logs: MediaWiki debug or error logs showing unusual query conditions being processed by SMW\Query\DebugFormatter.
• Network: Outbound connections from victim browsers to unexpected external domains shortly after accessing a Special:Ask debug URL, potentially indicating data exfiltration via injected scripts.

The fix is available in Semantic MediaWiki version 7.2.0, released July 17–18, 2026, which applies proper output-context HTML escaping at the DebugFormatter boundary across all affected sinks (buildHTML(), prettifySQL(), prettifyExplain()). Administrators should upgrade the mediawiki/semantic-media-wiki Composer package to 7.2.0 or later immediately. As a temporary workaround where upgrading is not immediately possible, consider restricting access to Special:Ask for unauthenticated users via MediaWiki's permission configuration ($wgGroupPermissions), though this does not eliminate the vulnerability for authenticated users (SMW Advisory, SMW Release).

The vulnerability was reported by researcher krabina and published by maintainer alistair3149 as part of a broader effort to split a consolidated security report (GHSA-5jhc-3j2f-52rv) into individual per-vulnerability advisories. No significant broader media coverage or notable social media commentary has been identified beyond the GitHub advisory publication (SMW Advisory).