Wikimedia UrlShortener CVE-2026-13706

EUVD-2026-41032 NONE

Improper Input Validation (CWE-20)

2026-07-01 wikimedia-foundation

GHSA-v4ch-5p7w-6w58

PHP Information Disclosure Urlshortener Wikimedia Foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

0.0 NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI

4.3 MEDIUM

Network-accessible, low complexity; PR:L per provided vector; C:L reflects Information Disclosure tag despite zero-impact provided CVSS, flagged as contradictory.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:06 vuln.today

DescriptionCVE.org

Improper input validation vulnerability in Wikimedia Foundation UrlShortener.

This vulnerability is associated with program files includes/UrlShortenerUtils.Php.

AnalysisAI

Improper input validation in Wikimedia Foundation's UrlShortener extension (includes/UrlShortenerUtils.php) exposes a potential information disclosure path accessible to low-privileged authenticated users over the network. The vulnerability is classified under CWE-20 and tagged as an information disclosure issue, though the provided CVSS 4.0 vector records zero impact across all dimensions - a notable contradiction with the 'Information Disclosure' tag that warrants independent verification. No public exploit code exists and no active exploitation has been confirmed.

Technical ContextAI

The affected component is the Wikimedia Foundation UrlShortener MediaWiki extension, specifically the PHP utility class UrlShortenerUtils.php (CPE: cpe:2.3:a:wikimedia_foundation:urlshortener:*:*:*:*:*:*:*:*). This extension provides URL shortening functionality for Wikimedia projects (e.g., w.wiki short links). CWE-20 (Improper Input Validation) indicates the root cause: the application fails to adequately validate, sanitize, or constrain input before using it in logic within UrlShortenerUtils.php. In URL shortening services, insufficient input validation commonly enables bypass of URL allowlists/denylists, enumeration of internal shortened URL mappings, or leakage of internal resource paths if arbitrary or crafted inputs are accepted by the shortening or resolution logic.

RemediationAI

No vendor-released patch or fixed version has been independently confirmed at time of analysis - the sole reference is the Wikimedia Phabricator task T418533 (https://phabricator.wikimedia.org/T418533), which should be monitored for patch availability and exact fixed version. As a compensating control, administrators running the UrlShortener extension should restrict access to URL shortening creation endpoints to trusted, authenticated users only, reducing exposure consistent with the PR:L attack vector. Disabling the UrlShortener extension entirely on non-public or internal MediaWiki deployments is an effective workaround with the trade-off of losing short-link functionality. Input validation hardening in UrlShortenerUtils.php (e.g., strict allowlisting of acceptable URL schemes and domains) should be validated once the upstream patch is released.