Semantic MediaWiki CVE-2026-77609

Exploitation requires the Semantic MediaWiki extension (version <= 7.1.0) installed on a MediaWiki site with the Special:URIResolver special page reachable, which is its default state. The attacker needs no authentication (PR:N) and no server configuration change, but success depends on victim interaction (UI:R): a target must click or follow the attacker-crafted Special:URIResolver/<subpage> link. Impact is limited to redirecting that victim to an attacker-influenced host (optionally with embedded user:pass@host credentials) for phishing - it does not by itself expose server data or allow code execution. The primary limiting factors are the required user interaction and the fact that harm is realized only through downstream social engineering on the redirected host.

This is a genuine but low-severity issue best treated as a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) is the textbook reflected open-redirect profile: network-reachable, no authentication, but requiring victim interaction (clicking a crafted link), with only limited confidentiality/integrity impact and a scope change reflecting redirection to a different security authority (the foreign host). No EPSS score, no CISA KEV listing, and no weaponized exploit are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - though the vendor advisory does document a concrete reproduction payload (Special:URIResolver/mw-3AFoo → mw:Foo → mediawiki.org). The signals are internally consistent: this is a real, easily-triggered flaw but its impact is phishing/credential-harvesting facilitation rather than direct compromise of the wiki. It is a high-quality vendor-confirmed advisory but a low-real-risk issue in the sense that it does not yield code execution, data theft from the server, or service disruption by itself; the danger is entirely in social-engineering leverage from a trusted wiki domain.

An attacker crafts a URL on a trusted wiki such as https://victim-wiki.example/wiki/Special:URIResolver/mw-3AFoo (or one embedding user:pass@attacker-host credentials in the resolved authority) and distributes it via email or chat. When a victim clicks the trusted-looking link, Semantic MediaWiki resolves the subpage to a title and issues an HTTP 303 redirect to an attacker-influenced off-host destination, landing the victim on a phishing page. The vendor advisory documents a working reproduction payload, but no standalone exploit tool is publicly identified.