AIKIDO-2026-992704

mediawiki/semantic-media-wiki is vulnerable to Open Redirect

Open RedirectGHSA-hw3m-8j5x-94ff Published 4 days ago

Medium Risk

This Affects:

mediawiki/semantic-media-wiki

0.0.1 - 7.1.0

Fixed in 7.2.0

Are you affected? Scan for Free

TL;DR

Semantic MediaWiki's Special:URIResolver resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to the resolved full URL without validating the target. A crafted subpage can resolve to an off-host target through an interwiki prefix or an authority containing embedded credentials, redirecting visitors to an external host. This enables phishing from a trusted wiki URL without authentication. The fix parses the resolved target and rejects the redirect when credentials are present or the host does not match the current host.

Who does this affect?

You are affected if you run an affected version with Special:URIResolver reachable, which is enabled by default. A crafted subpage that resolves off-host (via an interwiki prefix or embedded user:pass@host credentials) redirects visitors to an external site; no authentication is required and the victim only needs to follow a crafted link.