Semantic MediaWiki vulnerabilities
We track 7 vulnerabilities in Semantic MediaWiki products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Semantic MediaWiki vulnerabilities
- 7.3 High severity
SemanticMediaWiki: Missing Authorization
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read interna
- 7.1 High severity
SemanticMediaWiki: Cross-Site Request Forgery
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious pag
- 7.5 High severity
SemanticMediaWiki: Uncontrolled Resource Consumption
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requ
- 7.1 High severity
SemanticMediaWiki: Missing Authorization
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater app
- 7.3 High severity
SemanticMediaWiki: Missing Authorization
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-job
- 7.5 High severity
SemanticMediaWiki: Inefficient Algorithmic Complexity
Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many disti
- 7.5 High severity
SemanticMediaWiki: Uncontrolled Recursion
Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to