CVE-2026-13706

UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG PUBLISHED

Description (CNA)

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php.

Affected (CNA)

Vendor / product	Versions
Wikimedia Foundation / UrlShortener	affected * through 1.46.0, 1.45.4, 1.44.6, 1.43.9

CWE

CWE-20

References

https://phabricator.wikimedia.org/T418533

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.