CVE-2026-77616: 
PHP vulnerability analysis and mitigation

CVE-2026-77616 is a reflected cross-site scripting (XSS) vulnerability in Semantic MediaWiki (SMW), a free open-source MediaWiki extension, affecting versions 7.0.0 through 7.1.0. The flaw exists in the Special:Ask page's cursor-based pagination feature introduced in version 7.0.0, where attacker-controlled values from a forged cursor token are rendered as raw HTML without sanitization. It was published on July 18, 2026 by maintainer alistair3149 and added to the GitHub Advisory Database on September 18, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The Special:Ask endpoint accepts a cursor query parameter (p[cursor]=) for keyset pagination; this token is a base64url-encoded JSON blob with no signature or integrity protection, making its contents fully attacker-controlled. When the cursor's sort_prop or sort_order fields do not match the request's sort=/order= parameters, QueryCreator::applyCursorIfRequested() interpolates these raw attacker-supplied values into an error string via Query::addErrors(). This error string bypasses ProcessingErrorMsgHandler::normalizeAndDecodeMessages() sanitization (which only sanitizes message-key-based errors), and is ultimately passed to Html::errorBox() whose first argument is emitted as raw HTML, executing arbitrary script in the victim's browser. No authentication is required, and the affected wiki responses carry no Content-Security-Policy header to block inline scripts (GitHub Advisory, SMW Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the wiki's origin, enabling session cookie theft, credential harvesting, wiki content manipulation on behalf of the victim, or redirection to malicious sites. The scope is changed (cross-origin impact possible), with low confidentiality and integrity impact and no availability impact. Because no authentication is required, any wiki user who clicks a crafted link is at risk, including administrators whose elevated privileges could be abused for further compromise (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the advisory date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction (a victim must click a crafted link) but requires no authentication or special permissions, lowering the barrier for opportunistic attacks (GitHub Advisory, Feedly).

1. Identify target: Locate a MediaWiki instance running Semantic MediaWiki versions 7.0.0–7.1.0 with Special:Ask accessible (no authentication required).
2. Craft malicious cursor token: Construct a JSON payload such as {"v":1,"sort_prop":"<script>alert(document.cookie)</script>","sort_order":"asc"} and encode it as a base64url string (no signature needed).
3. Build the exploit URL: Append the encoded token to a Special:Ask URL as the cursor parameter, e.g., https://wiki.example.com/Special:Ask?q=[[Category:Foo]]&p[cursor]=<base64url_token>, ensuring the sort= parameter in the URL does not match the sort_prop in the token to trigger the error path.
4. Deliver the link: Send the crafted URL to a target victim via phishing email, social engineering, or embedding in wiki content.
5. Script executes: When the victim clicks the link, the wiki renders the error message containing the unsanitized sort_prop value as raw HTML, executing the injected script in the victim's browser on the wiki origin, enabling session theft or further actions (GitHub Advisory, SMW Advisory).

• Network: HTTP GET requests to Special:Ask containing a p[cursor]= parameter with base64url-encoded values that decode to JSON with HTML/script tags in sort_prop or sort_order fields; unusual outbound requests from victim browsers to attacker-controlled domains following wiki page loads.
• Logs: Web server access logs showing requests to /Special:Ask with p[cursor]= parameters containing encoded payloads; error log entries from SMW's query processing pipeline indicating cursor/sort mismatch errors.
• File System: No file system artifacts expected for this reflected XSS; however, if the XSS is used to deliver a persistent payload (e.g., via wiki edit), look for unexpected script content in wiki page revisions.

Upgrade Semantic MediaWiki to version 7.2.0, which output-encodes attacker-controlled sort_prop and sort_order values before they are interpolated into error strings in QueryCreator, preventing raw user input from entering the HTML error stream (SMW Release). As a defense-in-depth measure, deploying a Content-Security-Policy header that restricts inline script execution on the wiki origin would mitigate the impact of this and similar XSS vulnerabilities. No configuration-based workaround that fully mitigates the vulnerability without upgrading has been documented by the vendor (GitHub Advisory).