PatchClock

PHP security digest · Packages

mediawiki/semantic-media-wiki security advisories

9 advisories we have followed since September 2026, 2 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. High 18 Sep 2026

    Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

    Fixed in 7.3.0 · GHSA-jr78-w6w5-m8f8

  2. Medium 18 Sep 2026

    Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

    Fixed in 7.2.1 · GHSA-9rcc-pmj8-ffhr

  3. Medium 18 Sep 2026

    Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

    Fixed in 7.2.0 · CVE-2026-77616

  4. Medium 18 Sep 2026

    Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

    Fixed in 7.2.0 · CVE-2026-77610

  5. Medium 18 Sep 2026

    Semantic MediaWiki has an open redirect in Special:URIResolver

    Fixed in 7.2.0 · CVE-2026-77609

  6. Medium 18 Sep 2026

    Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

    Fixed in 7.2.0 · CVE-2026-77607

  7. Medium 18 Sep 2026

    Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

    Fixed in 7.2.0 · CVE-2026-77608

  8. Medium 18 Sep 2026

    Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

    Fixed in 7.2.0 · CVE-2026-77606

  9. High 18 Sep 2026

    Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

    Fixed in 7.0.0 · CVE-2025-61682

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including mediawiki/semantic-media-wiki, and the version that fixes it.