Executive brief
Semantic MediaWiki is a semantic layer for MediaWiki that extends its capabilities with structured data. The Special:URIResolver page contains an open redirect vulnerability that allows attackers to craft URLs appearing to originate from a trusted wiki but actually redirecting to attacker-controlled hosts. This can be used for phishing attacks against wiki users and staff.
Technical details
The vulnerability is an open redirect (CWE-601) in the Special:URIResolver page. The vulnerable component processes user-controlled subpage parameters and resolves them to MediaWiki titles, then issues an HTTP 303 redirect to the resolved URL without validating the target host. An attacker can craft a URL using interwiki prefixes (e.g., mw-3AFoo decoding to mw:Foo) or embed credentials (user:pass@host) to redirect to off-host destinations. The attack requires user interaction (clicking the link) and is network-accessible without authentication. The patch validates the resolved target URL and host matches against the current host before issuing the redirect.
Affected products
- Semantic MediaWiki Semantic MediaWiki <= 7.1.0
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Version 7.2.0 patches the vulnerability