EUVD-2026-41099
GHSA-q84p-w2wj-782m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Open redirect exploitation requires victim to click a crafted link (UI:R); redirect crosses to external domain establishing scope change (S:C); no availability impact applies to this class of vulnerability.
Primary rating from Vendor (wikimedia-foundation).
CVSS VectorVendor: wikimedia-foundation
Lifecycle Timeline
2DescriptionCVE.org
URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing.
This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.
AnalysisAI
Open redirect exploitation in the Wikimedia Foundation MediaWiki UrlShortener Extension enables unauthenticated network attackers to craft shortened URLs hosted on trusted MediaWiki domains that silently redirect victims to arbitrary external sites, facilitating phishing and Cross-Site Flashing attacks. All versions of the extension prior to 1.43.9, 1.44.6, and 1.45.4 across their respective branches are affected. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the unauthenticated and network-accessible nature of URL shortener services makes social-engineering abuse low-effort once a target instance is identified.
Technical ContextAI
The UrlShortener Extension for MediaWiki provides URL-shortening functionality that maps short redirect endpoints to longer target URLs, commonly deployed to produce compact wiki links. CWE-601 (URL Redirection to Untrusted Site) identifies the root cause: the extension fails to adequately validate or restrict destination URLs it stores and resolves, permitting registration of arbitrary external URLs as redirect targets. The affected CPE is cpe:2.3:a:the_wikimedia_foundation:mediawiki_-_urlshortener_extension:*:*:*:*:*:*:*:*. Cross-Site Flashing (XSF) is a historically Flash-specific attack technique that exploited permissive crossdomain.xml policies to load SWF content across origins; the CVE description's reference to XSF suggests the redirect endpoint could be leveraged to serve or load Flash content from an attacker-controlled domain, bypassing origin trust checks. Given Adobe Flash's end-of-life status, the XSF technique's practical scope is substantially reduced in modern environments, though the open redirect capability itself is independently exploitable for phishing and credential harvesting regardless of Flash.
RemediationAI
Upgrade the MediaWiki UrlShortener Extension to the patched release corresponding to your MediaWiki branch: 1.43.9, 1.44.6, or 1.45.4. The upstream code fix is available in Gerrit change I7a59cc4c351b5aa47ed46f7a14a1105fd1ecc5b5 (https://gerrit.wikimedia.org/r/q/I7a59cc4c351b5aa47ed46f7a14a1105fd1ecc5b5), with full context in Phabricator task T418431 (https://phabricator.wikimedia.org/T418431). If immediate patching is not feasible, disabling the UrlShortener Extension entirely via LocalSettings.php (removing or commenting out wfLoadExtension('UrlShortener')) eliminates the vulnerable endpoint; the trade-off is that all existing shortened URLs will stop resolving for the duration of the disablement. As a less disruptive interim measure, restricting the 'urlshortener-create-url' MediaWiki permission to trusted user groups reduces the attack surface by preventing unauthenticated or low-trust users from creating redirect targets, though this does not mitigate abuse by authenticated users with that permission.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today