TI-2026-54095 Aliases CVE-2026-77609 GHSA-hw3m-8j5x-94ff

Semantic MediaWiki has an open redirect in Special:URIResolver

LOW 27CWE-601Published 2026-09-18 · Updated 2026-09-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `Special:URIResolver` resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to `$title->getFullURL()` without validating the resolved target. A crafted subpage can make that target point off-host: an interwiki prefix redirects to the foreign wiki (for example `Special:URIResolver/mw-3AFoo`, which decodes to `mw:Foo`, redirects to `https://www.mediawiki.org/wiki/Foo`), and where the resolved URL carries an authority the target can even embed `user:pass@host` credentials. The result is an open redirect to an attacker-influenced host, usable for phishing from a trusted wiki URL. Version 7.2.0 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00268 19th percentileScored 2026-11-07

Fix Fixed SemanticMediaWiki (SemanticMediaWiki): 7.2.0mediawiki/semantic-media-wiki (Packagist): 7.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SemanticMediaWiki	SemanticMediaWiki	before 7.2.0	7.2.0	Patch available	CNA
—	mediawiki/semantic-media-wiki (Packagist)	before 7.2.0	7.2.0	Patch available	GHSA-hw3m-8j5x-94ff

SemanticMediaWiki VendorSemanticMediaWiki Affected before 7.2.0 Fixed in 7.2.0 Patch available CNA
mediawiki/semantic-media-wiki (Packagist) Vendor— Affected before 7.2.0 Fixed in 7.2.0 Patch available GHSA-hw3m-8j5x-94ff

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:semantic-mediawiki:semantic_mediawiki::::::::	—	—	SemanticMediaWiki

cpe:2.3:a:semantic-mediawiki:semantic_mediawiki:*:*:*:*:*:*:*:* Versions — — ·SemanticMediaWiki

Remediation

Fix · CNA SemanticMediaWiki (SemanticMediaWiki) Fixed in 7.2.0
Fix · GHSA-hw3m-8j5x-94ff mediawiki/semantic-media-wiki (Packagist) Fixed in 7.2.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-77609
2026-10-03 Alias added: GHSA-hw3m-8j5x-94ff

References

Other 3

TI-2026-81081 Resource exhaustion in Semantic MediaWiki via #set_recurring_event CVSS 4.0HIGH 8.7
TI-2026-81076 Semantic MediaWiki search lets attackers exhaust CPU via long terms CVSS 4.0HIGH 8.7
TI-2026-81075 Uncontrolled recursion in Semantic MediaWiki via Special:Ask CVSS 4.0HIGH 8.7
TI-2025-38114 Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes CVSS 3.1HIGH 8.6
TI-2026-81077 Missing authorization in Semantic MediaWiki smwtask API CVSS 4.0MEDIUM 6.9
TI-2026-81084 Cross-site request forgery in Semantic MediaWiki SMWAdmin page CVSS 4.0HIGH 7.1

See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences