rootpwn

medium · CVSS v3 6.1

CVE-2026-77609

Semantic MediaWiki extension allows open redirect via Special:URIResolver. Attackers can craft subpages that redirect to arbitrary external

Overview

Semantic MediaWiki extension allows open redirect via Special:URIResolver. Attackers can craft subpages that redirect to arbitrary external URLs, enabling phishing. The flaw exists in versions prior to 7.2.0.

Description

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `Special:URIResolver` resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to `$title->getFullURL()` without validating the resolved target. A crafted subpage can make that target point off-host: an interwiki prefix redirects to the foreign wiki (for example `Special:URIResolver/mw-3AFoo`, which decodes to `mw:Foo`, redirects to `https://www.mediawiki.org/wiki/Foo`), and where the resolved URL carries an authority the target can even embed `user:pass@host` credentials. The result is an open redirect to an attacker-influenced host, usable for phishing from a trusted wiki URL. Version 7.2.0 fixes the issue.

Impact

Open redirect can compromise confidentiality by leaking credentials if attacker uses user:pass in URL; integrity is threatened as users may be redirected to malicious sites; availability not directly affected. Defenders and end users are impacted.

Remediation

Upgrade Semantic MediaWiki to 7.2.0 or later. If upgrade not possible, disable Special:URIResolver or restrict interwiki prefixes. Monitor logs for unexpected redirects.

Risk context

Severity medium, no EPSS. The vulnerability is exploitable in any publicly accessible wiki using Semantic MediaWiki <7.2.0, making it a moderate risk that should be addressed promptly.

Affected products

  • Semantic MediaWiki
  • MediaWiki

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
6.1
CVSS v4
—
EPSS
—

open-redirect phishing Semantic MediaWiki MediaWiki medium-severity interwiki redirect

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-77608

Semantic MediaWiki extension for MediaWiki had a reflected XSS vulnerability due to insufficient output encoding of the 'value' parameter. This flaw could allow attackers to inject malicious scripts into wiki pages or error messages. The issue is fixed in version 7.2.0.

View analysis

medium

CVE-2026-77610

Semantic MediaWiki extension allows storing data in wiki pages. Prior to version 7.2.0, debug output from queries can be reflected as raw HTML, enabling reflected XSS. This affects any MediaWiki site using the extension and allows attackers to inject scripts via anonymous requests.

View analysis

medium

CVE-2026-77616

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, `Special:Ask` accepts a `cursor` query parameter for keyset pagination (added in 7.0.0). The token is decoded by `CursorEncoder`, which is an **unsigned** base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the cursor's sort anchor does not match the request's `sort=` / `order=`, `QueryCreator::applyCursorIfRequested()` builds an error message by interpolating the attacker-controlled `sort_prop` / `sort_order` values into a raw string via `Query::addErrors()`. Unlike SMW's message-key errors, this raw string bypasses the message layer's sanitization (`ProcessingErrorMsgHandler::normalizeAndDecodeMessages()` passes a non-key, non-encoded string through unchanged). `ErrorWidget::queryError()` then assembles the errors and passes them to `Html::errorBox()`, whose first argument is emitted as raw HTML. The result is a reflected cross-site scripting vulnerability: a crafted `cursor` token containing markup in `sort_prop` (or `sort_order`) executes script in the victim's browser on the wiki origin. No authentication or special permission is required. The payload is delivered via a crafted link. Version 7.2.0 contains a fix.

View analysis