CVE-2026-103048 in Collection Extension
Summary
by MITRE • 09/30/2026
URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.
This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in The Wikimedia Foundation's MediaWiki Collection extension represents a classic open redirect flaw that compromises the integrity of data sources by allowing attackers to manipulate URL redirections toward untrusted or malicious destinations. This issue specifically affects versions prior to 1.46.1, 1.45.5, and 1.43.10. The core technical failure lies in the extension's handling of user-supplied input within redirect parameters without adequate validation against a whitelist of trusted domains. When an application accepts arbitrary URLs for redirection purposes, it fails to verify that the target destination is part of the expected domain hierarchy or has been explicitly authorized by the administrator. This lack of strict output encoding and URL normalization allows attackers to craft malicious links that appear legitimate at first glance but ultimately redirect users to phishing sites, malware distribution centers, or other hostile environments under the guise of the trusted MediaWiki instance.
From a technical perspective, this vulnerability is categorized under CWE-601, which defines Open Redirect as a type of URL redirection flaw where an attacker can control the destination address used by the web application. The operational impact extends beyond simple defacement; it facilitates sophisticated social engineering attacks and credential harvesting campaigns. By leveraging the trusted reputation of the Wikimedia Foundation's infrastructure, attackers can deceive users into believing they are interacting with a secure, official service. This trust exploitation significantly increases the success rate of phishing attempts because victims are less likely to scrutinize URLs originating from well-known domains like wikimedia.org or its associated subdomains. Furthermore, this flaw can be chained with other vulnerabilities such as Cross-Site Scripting (XSS) if the redirect target allows for script injection in query parameters, thereby amplifying the potential damage and enabling session hijacking or malware delivery through drive-by downloads.
The attack vector typically involves an attacker constructing a specially crafted URL that points to the vulnerable endpoint of the Collection extension while embedding their malicious domain within the redirection parameter. When a victim clicks this link, the server processes the request without sufficient checks on the target host and issues an HTTP 3xx response directing the browser to the untrusted site. This process bypasses security controls such as Same-Origin Policy protections in certain contexts or confuses users who rely on visual cues like domain names for trust assessment. The absence of proper input validation means that relative paths, protocol-relative URLs, or encoded variations of malicious domains can successfully execute the redirect logic, making detection and prevention challenging without strict allow-listing mechanisms.
To mitigate this vulnerability, organizations running affected versions must immediately upgrade to MediaWiki Collection extension version 1.46.1, 1.45.5, or 1.43.10, which contain patches addressing the input validation logic. For environments where immediate patching is not feasible due to operational constraints, administrators should implement a strict allow-list of permitted redirect destinations at the web server level using tools like Nginx or Apache mod_rewrite rules that reject any redirection attempts targeting external domains. Additionally, deploying Web Application Firewalls (WAFs) with specific signatures for open redirect patterns can provide an additional layer of defense by blocking requests containing suspicious URL structures before they reach the application logic. Security teams should also conduct thorough code reviews to ensure no other endpoints within the extension or related modules suffer from similar validation deficiencies, as these flaws often exist in clusters across complex web applications.
This incident underscores the importance of adhering to secure coding practices outlined in industry standards such as OWASP Top 10, specifically under Injection and Broken Access Control categories where improper URL handling falls. The ATT&CK framework classifies this behavior within the Initial Access tactics, particularly Phishing techniques that leverage trusted infrastructure for credential harvesting or malware distribution. By understanding the mechanics of open redirects, security professionals can better anticipate how attackers exploit trust relationships in web applications. Continuous monitoring and regular updates to third-party extensions are critical components of a robust defense-in-depth strategy, ensuring that known vulnerabilities do not serve as entry points for broader system compromise.