PatchClock

PHP security digest · 18 Sep 2026

Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Medium CVE-2026-77606

Package
mediawiki/semantic-media-wiki
Fixed in
7.2.0
Published
Fri 18 Sep 2026, 17:40 LisbonUpdated Mon 26 Oct 2026, 00:26 Lisbon
Installs on Packagist
405K

In plain words

Semantic MediaWiki has a reflected cross-site scripting flaw in Special:Ask table headers when headers=plain is used. Attacker-controlled mainlabel content can be rendered as executable HTML rather than header text. The fix is in version 7.2.0.

Affected versions

PackageAffectedFixed in
mediawiki/semantic-media-wiki<= 7.1.07.2.0

Am I affected?

Check composer.lock for mediawiki/semantic-media-wiki at version 7.1.0 or earlier. If present, check whether Special:Ask tables use headers=plain and whether attacker-controlled content can reach mainlabel. The flaw affects the HTML/plain-header rendering branch.

What to do

Check which version you have, then update to a fixed release for your branch (7.2.0):

composer show mediawiki/semantic-media-wiki | grep versions
composer update mediawiki/semantic-media-wiki

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

Failure mode

When headers=plain, table header text was emitted into <th> via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML.

Remediation

  • TableResultPrinter now applies output-context escaping before passing plain headers to the table renderer.
  • The fix is limited to the HTML/plain-header branch so safe rendering modes are unaffected.

Why this is the right layer

The header value is not a structural token; it is display data. Sanitizing it at the sink is correct because the renderer owns the final HTML emission.

Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Reported by krabina.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description, affected versions, weakness and credits are from the GitHub Advisory Database (CC BY 4.0). "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.