Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-58520 EUVD-2026-41099GHSA-q84p-w2wj-782m

UrlShortener defaults to ineffective validation open to third-party redirects

Published Jul 1, 2026 · Updated Jul 1, 2026 · Assigned by wikimedia-foundation

Description

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing.

This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.

Affected products

VendorProductAffectedFixed
The Wikimedia Foundation Mediawiki - UrlShortener Extension < 1.43.9, 1.44.6, 1.45.4 1.43.9, 1.44.6, 1.45.4

Advisories 3

References