Semantic MediaWiki: Denial of service via Special:Search compact filters

Summary

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity flaw in the parsing of compact filters in Special:Search. An unauthenticated attacker can submit a long search term with many in:(...) or has:(...) expressions, which causes quadratic CPU consumption and can exhaust PHP search workers. The issue only applies when the extended search engine (ExtendedSearchEngine) is configured as the search backend. The vendor describes the impact as availability only.

Affected

• Semantic MediaWiki 3.0.0 up to but not including 7.3.1
• The issue requires the extended search engine (SMW\MediaWiki\Search\ExtendedSearchEngine or SMWSearch) as the configured search backend

Fixed in

• Semantic MediaWiki 7.3.1 (released 28 Sep 2026)
• Fix commit: c2bf1699dec4016e21ce52613152bda799ce87d4
• Per the maintainers, security fixes only go into the latest major version; versions 6 and older require an upgrade to 7.3.1

Workaround

Unknown. No official workaround is documented by the vendor.

• Not vendor-documented: switching away from the extended search engine, or restricting and rate-limiting Special:Search at the web server or reverse proxy, may reduce exposure

Exploitation

• The GHSA advisory includes a parser-only proof of concept; CISA SSVC lists exploitation as 'poc' and automatable as yes
• No evidence of active exploitation was found; one aggregator reports the CVE is not in CISA KEV (not verified)

Our recommendation

• Check whether the wiki runs Semantic MediaWiki 3.0.0 to 7.3.0 and whether the extended search engine is configured
• Prioritise internet-facing wikis and upgrade to 7.3.1 on a staging copy first; a major-version upgrade from 3.x to 7.x may also require MediaWiki 1.43 or later
• Until patched, restrict or rate-limit Special:Search and monitor PHP worker saturation

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-j2r2-7qpg-p675 github.com
• Fix commit c2bf1699 (TermParser.php) github.com
• VulnCheck advisory www.vulncheck.com
• Semantic MediaWiki 7.3.1 release github.com
• Semantic MediaWiki 7.3 release announcement (Professional Wiki) professional.wiki
• OffSeq Radar CVE-2026-116872 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:02.