# mediawiki/semantic-media-wiki (Packagist) vulnerabilities

10 known vulnerabilities (1 high, 8 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/mediawiki/semantic-media-wiki

## Advisories (10)

### [CVE-2026-116891](https://cve.now/CVE-2026-116891): SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate

- Severity: Medium 5.1
- Published: Oct 27, 2026
- Affected: from 4.2.0, fixed in 7.2.1.

### [CVE-2026-116890](https://cve.now/CVE-2026-116890): Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API

- Severity: Medium 6.9
- Published: Oct 27, 2026
- Affected: from 3.0.0, fixed in 7.3.0.

### [CVE-2026-77616](https://cve.now/CVE-2026-77616): Semantic MediaWiki affected by reflected XSS in \`Special:Ask\` via a forged cursor pagination token

- Severity: Medium 6.1
- Published: Sep 18, 2026
- Affected: from 7.0.0, fixed in 7.2.0.

### [CVE-2026-77610](https://cve.now/CVE-2026-77610): Semantic MediaWiki has a query debug output XSS (\`DebugFormatter\`)

- Severity: Medium 6.1
- Published: Sep 18, 2026
- Affected: fixed in 7.2.0.

### [CVE-2026-77609](https://cve.now/CVE-2026-77609): Semantic MediaWiki has an open redirect in Special:URIResolver

- Severity: Medium 6.1
- Published: Sep 18, 2026
- Affected: fixed in 7.2.0.

### [CVE-2026-77607](https://cve.now/CVE-2026-77607): Semantic MediaWiki affected by Special:Ask table \`sep\` parameter reflected XSS

- Severity: Medium 6.1
- Published: Sep 18, 2026
- Affected: fixed in 7.2.0.

### [CVE-2026-77608](https://cve.now/CVE-2026-77608): Semantic MediaWiki has reflected XSS in \`Special:SearchByProperty\` (\`property\` and \`value\` parameters)

- Severity: Medium 6.1
- Published: Sep 18, 2026
- Affected: fixed in 7.2.0.

### [CVE-2026-77606](https://cve.now/CVE-2026-77606): Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

- Severity: Medium 6.1
- Published: Sep 18, 2026
- Affected: fixed in 7.2.0.

### [CVE-2025-61682](https://cve.now/CVE-2025-61682): Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

- Severity: High 8.6
- Published: Sep 18, 2026
- Affected: from 3.1.0, fixed in 7.0.0.

### [CVE-2022-48614](https://cve.now/CVE-2022-48614): Special:Ask in Semantic MediaWiki before 4.0.2 allows Reflected XSS.

- Severity: Unrated
- Published: Dec 10, 2023
- Affected: fixed in 4.0.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/mediawiki/semantic-media-wiki
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.