CVE-2026-126562

MEDIUM 4.3

Semantic MediaWiki 3.0.0 before 7.4.1 Uncontrolled Recursion via ElasticStore ConceptDescriptionInterpreter

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter that only detects directly self-referencing concepts. Users with page-edit rights can create mutually referencing concept pages, causing concept page views, Special:Ask, or api.php action=ask queries to exhaust PHP memory or stack.

CWE	CWE-674
Vendor	semanticmediawiki
Product	semanticmediawiki
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for semanticmediawiki semanticmediawiki

Be the first to know when new medium vulnerabilities affecting semanticmediawiki semanticmediawiki are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

SemanticMediaWiki / SemanticMediaWiki

3.0.0 < 7.4.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-jwx8-mm92-gv95 github.com: https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/35d8f8c9c7b48a476751ca0b795b78b648756828 github.com: https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1 github.com: https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Elastic/QueryEngine/DescriptionInterpreters/ConceptDescriptionInterpreter.php#L34-L75 vulncheck.com: https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-uncontrolled-recursion-via-elasticstore-conceptdescriptioninterpreter

Credits

AlpetGexha