Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
10 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The `api.php?action=smwtask` API module performs no authorization check. The equivalent maintenance interface in the web UI (`Special:SMWAdmin`) requires the `smw-admin` right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore retrieve internal Semantic MediaWiki database statistics and reach state-changing maintenance operations that are intended to be administrator-only. Details `SMW\MediaWiki\Api\Task::execute()` (`src/MediaWiki/Api/Task.php`) reads the request parameters, resolves a task through `TaskFactory`, and runs it. It contains no permission check — no `smw-admin`, no `checkUserRightsAny()`, no per-task right. The only gates on the module are: - `needsToken( 'csrf' )` — this is not authorization. MediaWiki issues anonymous users a fixed, public CSRF token (`+\`), so any unauthenticated caller satisfies the token check. It defends logged-in users against CSRF; it does nothing against a…
Recommended action: Upgrade to 7.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Special:FacetedSearch `cstate` hidden inputs enable reflected XSS (residual of CVE-2025-10354) Details Affected versions and vulnerable location - Confirmed present on latest shipped release tag available in the local clone: `SemanticMediaWiki/SemanticMediaWiki@7.2.0`. - Confirmed present on default branch `master` at HEAD `18f418b4cdf2875e67a741349179a22c1573f61c`. Vulnerable sink (default-branch representation): - `src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php:131-133` - Builds `$hidden` by concatenating unescaped request-controlled `cstate[$key]` values into an HTML attribute context (`value="..."`). - `templates/FacetedSearch/search.mustache:25` - Inserts the constructed fragment via `{{{hidden}}}` (no HTML escaping at this boundary). Reachability trace (verified from source) 1. HTTP entrypoint: - `GET` to `Special:FacetedSearch` dispatches into `SMW\MediaWiki\Specials\SpecialFacetedSearch::execute()`. 2. Request decoding boundary: -…
Recommended action: Upgrade to 7.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Reflected XSS via a forged cursor pagination token Failure mode Special:Ask accepts a cursor query parameter for keyset pagination (added in 7.0.0). The token is decoded by CursorEncoder, which is an unsigned base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the cursor's sort anchor does not match the request's sort= / order=, QueryCreator::applyCursorIfRequested() builds an error message by interpolating the attacker-controlled sortprop / sortorder values into a raw string via Query::addErrors(). Unlike SMW's message-key errors, this raw string bypasses the message layer's sanitisation (ProcessingErrorMsgHandler::normalizeAndDecodeMessages() passes a non-key, non-encoded string through unchanged). ErrorWidget::queryError() then assembles the errors and passes them to Html::errorBox(), whose first argument is emitted as raw HTML. The result is a reflected cross-site scripting vulnerability: a crafted cursor token containing markup in sortprop (or…
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Query debug output XSS Failure mode Semantic MediaWiki's query debug output (format=debug, or the debug request parameter on Special:Ask) is assembled by SMW\Query\DebugFormatter and emitted as raw HTML. Several of its sinks apply no output-context encoding, so attacker-controlled query input is reflected into the page without escaping: - buildHTML() echoes the re-serialized ASK query string escaping only ; <, , ", ' pass through. - prettifySQL() returns the generated SQL verbatim. Query value literals are inlined into the SQL through the database layer's quoting (SQL-escaping only, no HTML encoding), so markup in a value survives. - prettifyExplain() echoes EXPLAIN output; on PostgreSQL the plan text contains the WHERE literals. On Special:Ask the resulting string is concatenated into the page and sent through OutputPage::addHTML, never through the MediaWiki parser or Sanitizer. No special user right is required; an anonymous request suffices. This is a reflected XSS: the payload…
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failure mode Special:URIResolver resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to $title-getFullURL() without validating the resolved target. A crafted subpage can make that target point off-host: an interwiki prefix redirects to the foreign wiki (for example Special:URIResolver/mw-3AFoo, which decodes to mw:Foo, redirects to https://www.mediawiki.org/wiki/Foo), and where the resolved URL carries an authority the target can even embed user:pass@host credentials. The result is an open redirect to an attacker-influenced host, usable for phishing from a trusted wiki URL. Remediation - The resolved target URL is parsed and compared against the current host at the redirect sink. - The redirect is rejected (bad-title error page) when a user or pass component is present, or when the host does not match the current host. Maintenance note Redirect code must validate the final target URL, not just the input path. Host comparison belongs at the…
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failure mode sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output (requesttype=raw), so the injection was reachable without authentication. Remediation - In all non-wiki output modes (HTML, raw request, file), sep is escaped unless it is a safe <br variant. - This preserves legitimate line-break separators while blocking markup injection. Maintenance note If the table renderer ever gains richer separator semantics, keep the whitelist explicit. Do not expand the allowed HTML surface casually.
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failure mode The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation - The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into HTML. Maintenance note Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failure mode When headers=plain, table header text was emitted into <th via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Remediation - TableResultPrinter now applies output-context escaping before passing plain headers to the table renderer. - The fix is limited to the HTML/plain-header branch so safe rendering modes are unaffected. Why this is the right layer The header value is not a structural token; it is display data. Sanitizing it at the sink is correct because the renderer owns the final HTML emission.
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SemanticMediaWiki extension inserts the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Details In ext.smw.js, the data-subtab attribute of all elements with the smw-subtab class is parsed as JSON and appended to the innerHTML of the element: https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/62f1fa765b626e21d88999b97a3e8029db9fd385/res/smw/ext.smw.js#L37-L42 However, most data attributes (except for reserved ones) like data-subtab can be used in wikitext. Therefore, it is possible to insert arbitrary HTML and JS through wikitext. The decoded (" will turn to ", but it will be decoded when it is retrieved through .dataset) value of the data-subtab attribute in the payload is "<img src='' onerror=alert(1)". This is valid JSON and returns a string with <img src='' onerror=alert(1) when being decoded. PoC 1. Create a page with the following contents: 2. Visit the page <img width="991" height="465" alt="image"…
Recommended action: Upgrade to 7.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Special:Ask in Semantic MediaWiki before 4.0.2 allows Reflected XSS.
Recommended action: Upgrade to 4.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.