AIKIDO-2026-992704
mediawiki/semantic-media-wiki is vulnerable to Open Redirect
61
CVE Score
Medium
Open Redirect
TL;DR
Semantic MediaWiki's Special:URIResolver resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to the resolved full URL without validating the target. A crafted subpage can resolve to an off-host target through an interwiki prefix or an authority containing embedded credentials, redirecting visitors to an external host. This enables phishing from a trusted wiki URL without authentication. The fix parses the resolved target and rejects the redirect when credentials are present or the host does not match the current host.
How do I fix this?
Upgrade the mediawiki/semantic-media-wiki library to the patch version.
Who does this affect?
You are affected if you run an affected version with Special:URIResolver reachable, which is enabled by default. A crafted subpage that resolves off-host (via an interwiki prefix or embedded user:pass@host credentials) redirects visitors to an external site; no authentication is required and the victim only needs to follow a crafted link.
Versions
0.0.1 - 7.1.0
Fixed in 7.2.0Background info
mediawiki/semantic-media-wiki is vulnerable to Open Redirect in versions 0.0.1 - 7.1.0.
Links
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.