Advisories for Composer/Mediawiki/Semantic-Media-Wiki package

Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

The api.php?action=smwtask API module performs no authorization check. The equivalent maintenance interface in the web UI (Special:SMWAdmin) requires the smw-admin right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore retrieve internal Semantic MediaWiki database statistics and reach state-changing maintenance operations that are intended to be administrator-only.

The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext.

Failure mode When headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Remediation TableResultPrinter now applies output-context escaping before passing plain headers to the table renderer. The fix is limited to the HTML/plain-header branch so safe rendering modes are unaffected. Why this is the right layer The header value is not a structural token; it is display data. …

Failure mode The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation The form value is escaped before it is placed back into the input field. Derived error messages are also escaped before being rendered into HTML. Maintenance note Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.

Failure mode Special:URIResolver resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to $title->getFullURL() without validating the resolved target. A crafted subpage can make that target point off-host: an interwiki prefix redirects to the foreign wiki (for example Special:URIResolver/mw-3AFoo, which decodes to mw:Foo, redirects to https://www.mediawiki.org/wiki/Foo), and where the resolved URL carries an authority the target can even embed user:pass@host credentials. The result is an …

Query debug output XSS Failure mode Semantic MediaWiki's query debug output (format=debug, or the debug request parameter on Special:Ask) is assembled by SMW\Query\DebugFormatter and emitted as raw HTML. Several of its sinks apply no output-context encoding, so attacker-controlled query input is reflected into the page without escaping: buildHTML() echoes the re-serialized ASK query string escaping only [; <, >, ", ' pass through. prettifySQL() returns the generated SQL verbatim. Query …

Failure mode sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output (request_type=raw), so the injection was reachable without authentication. Remediation In all non-wiki output modes (HTML, raw request, file), sep is escaped unless it is a …

Reflected XSS via a forged cursor pagination token Failure mode Special:Ask accepts a cursor query parameter for keyset pagination (added in 7.0.0). The token is decoded by CursorEncoder, which is an unsigned base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the cursor's sort anchor does not match the request's sort= / order=, QueryCreator::applyCursorIfRequested() builds an error message by interpolating the attacker-controlled sort_prop / sort_order values into a raw …

Special:Ask in Semantic MediaWiki before 4.0.2 allows Reflected XSS.