PatchClock

PHP security digest · 18 Sep 2026

Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Medium CVE-2026-77608

Package
mediawiki/semantic-media-wiki
Fixed in
7.2.0
Published
Fri 18 Sep 2026, 17:42 LisbonUpdated Mon 26 Oct 2026, 00:26 Lisbon
Installs on Packagist
405K

In plain words

An attacker can cause script to run in a user's browser through reflected cross-site scripting in Special:SearchByProperty. The flaw occurs when attacker-controlled value input is reflected into the form or error messages without sufficient output-context escaping.

Affected versions

PackageAffectedFixed in
mediawiki/semantic-media-wiki<= 7.1.07.2.0

Am I affected?

Check composer.lock for mediawiki/semantic-media-wiki at version 7.1.0 or earlier. The affected feature is Special:SearchByProperty, with the advisory naming the property and value parameters. No additional configuration or database condition is specified. Version 7.2.0 contains the fix.

What to do

Check which version you have, then update to a fixed release for your branch (7.2.0):

composer show mediawiki/semantic-media-wiki | grep versions
composer update mediawiki/semantic-media-wiki

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

Failure mode

The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding.

Remediation

  • The form value is escaped before it is placed back into the input field.
  • Derived error messages are also escaped before being rendered into HTML.

Maintenance note

Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.

Weakness: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Reported by krabina.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description, affected versions, weakness and credits are from the GitHub Advisory Database (CC BY 4.0). "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.