Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mediawiki/semantic-media-wiki | composer | <= 7.1.0 | 7.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-77606 (GHSA-3jp5-3h47-28qf), describes a reflected XSS in Special:Ask when headers=plain is used, allowing user-controlled mainlabel content to become executable HTML. The advisory explicitly states that TableResultPrinter was modified to apply output-context escaping for plain headers.
My analysis focused on the src/Query/ResultPrinters/TableResultPrinter.php file, as indicated by the advisory. Within this class, the getResultText method is responsible for generating the table's HTML, including its headers. The code block responsible for processing headers iterates through PrintRequest objects and retrieves their text using $pr->getText(). In the vulnerable version, when headers=plain was active, the mainlabel content, which is part of the PrintRequest's text, was directly inserted into the <th> HTML tags without proper sanitization. This allowed for XSS.
The fix, introduced in version 7.2.0, involves adding a conditional htmlspecialchars call within the getResultText method. Specifically, the line $text = htmlspecialchars( (string)$text, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8' ); was added (or modified to be effective) to escape the header text ($text) if the output mode is HTML and the headers are set to 'plain'. This ensures that any malicious input in the mainlabel is rendered as harmless text rather than executable code.
Therefore, the SMW\Query\ResultPrinters\TableResultPrinter::getResultText function is identified as the vulnerable function because it was the point where user-controlled input (mainlabel content) was processed and outputted into HTML headers without adequate escaping in the vulnerable versions, directly leading to the XSS. The patch evidence is the introduction of the htmlspecialchars call within this method to sanitize the header text under the specified conditions.
SMW\Query\ResultPrinters\TableResultPrinter::getResultTextsrc/Query/ResultPrinters/TableResultPrinter.php