SemanticMediaWiki vulnerabilities
We track 10 vulnerabilities in SemanticMediaWiki products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest SemanticMediaWiki vulnerabilities
- 7.1 High severity
SemanticMediaWiki: Incorrect Authorization
Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false
- 7.1 High severity
SemanticMediaWiki: Missing Authorization
Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set i
- 7.3 High severity
SemanticMediaWiki: Missing Authorization
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read interna
- 7.1 High severity
SemanticMediaWiki: Cross-Site Request Forgery
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious pag
- 7.5 High severity
SemanticMediaWiki: Uncontrolled Resource Consumption
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requ
- 7.1 High severity
SemanticMediaWiki: Missing Authorization
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater app
- 7.3 High severity
SemanticMediaWiki: Missing Authorization
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-job
- 7.5 High severity
SemanticMediaWiki: Inefficient Algorithmic Complexity
Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many disti
- 7.5 High severity
SemanticMediaWiki: Uncontrolled Recursion
Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to
- 8.6 High severity
SemanticMediaWiki: Improper Neutralization of Input During Web Page Generation
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for sto