Executive brief
A vulnerability in the MediaWiki UrlShortener extension could allow attackers to redirect users to malicious third-party websites. This extension is used to create shortened links for wiki pages, and the flaw allows these links to point to unauthorized external domains. An exploit could be used in phishing campaigns to trick users into visiting untrusted sites while appearing to stay within a trusted wiki environment.
Technical details
The UrlShortener extension for MediaWiki contains an open redirect vulnerability due to ineffective validation of the 'UrlShortenerAllowedDomains' setting. When this setting is at its default (false), the extension generates a regular expression to validate the host but fails to include start (^) and end ($) anchors. This allows an attacker to craft 'imposter' URLs that contain the trusted domain as a substring, bypassing the intended restriction to the local host. The vulnerability can be exploited remotely without authentication to facilitate cross-site flashing or phishing. Patches have been released in versions 1.43.9, 1.44.6, and 1.45.4.
Affected products
- The Wikimedia Foundation Mediawiki - UrlShortener Extension before 1.43.9, 1.44.6, 1.45.4
Timeline
- 2026-02-26: disclosed: Issue reported internally via Phabricator.
- 2026-04-27: patched: Fix resolved and prepared for deployment.
- 2026-07-01: advisory: Public advisory and CVE published.