Skip to content
OpenAdvisories
None · 0.0 CVE-2026-13706 EUVD-2026-41032GHSA-v4ch-5p7w-6w58

UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG

Published Jul 1, 2026 · Updated Jul 1, 2026 · Assigned by wikimedia-foundation

Vendor: Wikimedia Foundation Product: UrlShortener

Description

Improper input validation vulnerability in Wikimedia Foundation UrlShortener.

This vulnerability is associated with program files includes/UrlShortenerUtils.Php.

Affected products

VendorProductAffectedFixed
Wikimedia Foundation UrlShortener ≤ 1.46.0, 1.45.4, 1.44.6, 1.43.9 —

References