Semantic MediaWiki: Reflected cross-site scripting via Special:Ask date format
Summary
Semantic MediaWiki, an extension for MediaWiki that adds semantic queries to wiki pages, does not escape free-format date captions in HTML output. An unauthenticated attacker can craft a Special:Ask URL containing HTML markup in a date printout format and trick a logged-in user into opening it. The script then runs in the victim's browser session, which can expose or modify wiki content, especially for administrators.
Affected
- Semantic MediaWiki 2.4.0 up to and including 7.4.0 (before 7.4.1)
Fixed in
- Upgrade to Semantic MediaWiki 7.4.1 or later
Workaround
- Unknown.
Exploitation
- No evidence of exploitation in the wild found at the time of writing.
- No public proof-of-concept exploit confirmed.
- VulDB rates exploitation as easy; this is a rating, not evidence of active use.
Our recommendation
- Upgrade Semantic MediaWiki to 7.4.1 or later; the same release also fixes related same-day advisories.
- Until patched, restrict access to Special:Ask on internet-facing wikis where possible.
- Remind administrators not to open untrusted links while logged in to the wiki.
- Check the installed version of the extension and monitor the vendor advisory GHSA-h252-mj7p-58q7.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126563 www.cve.org
- GitHub Security Advisory GHSA-h252-mj7p-58q7 github.com
- Fix commit 01cb81a6 github.com
- Semantic MediaWiki release 7.4.1 github.com
- Vulnerable code TimeValueFormatter.php at 7.4.0 github.com
- VulnCheck advisory www.vulncheck.com
- VulDB entry 435578 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:11.
Original description (NVD)
Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout format (#-F[...]) to execute script in a logged-in victim's browser session.
NVD references (6)
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/DataValues/ValueFormatters/TimeValueFor…
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/01cb81a6da7af743d2a5eb334db10e52b7318c56
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-h252-mj7p-58q7
- https://www.vulncheck.com/advisories/semantic-mediawiki-2.4.0-before-7.4.1-reflected-xss-via-special-ask-date…
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-h252-mj7p-58q7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.