CVE-2026-58520 — UrlShortener defaults to ineffective validation open to third-party redirects

CVE-2026-58520

UrlShortener defaults to ineffective validation open to third-party redirects PUBLISHED

Description (CNA)

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.

Affected (CNA)

Vendor / product	Versions
The Wikimedia Foundation / Mediawiki - UrlShortener Extension	affected * before 1.43.9, 1.44.6, 1.45.4

CWE

CWE-601

References

https://phabricator.wikimedia.org/T418431
https://gerrit.wikimedia.org/r/q/I7a59cc4c351b5aa47ed46f7a14a1105fd1ecc5b5

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.