CVE-2026-77609 in Semantic MediaWiki
Summary
by MITRE • 09/18/2026
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `Special:URIResolver` resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to `$title->getFullURL()` without validating the resolved target. A crafted subpage can make that target point off-host: an interwiki prefix redirects to the foreign wiki (for example `Special:URIResolver/mw-3AFoo`, which decodes to `mw:Foo`, redirects to `https://www.mediawiki.org/wiki/Foo`), and where the resolved URL carries an authority the target can even embed `user:pass@host` credentials. The result is an open redirect to an attacker-influenced host, usable for phishing from a trusted wiki URL. Version 7.2.0 fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
Semantic MediaWiki serves as a powerful extension for the MediaWiki platform, enabling users to store structured data and perform complex queries directly within wiki pages. This functionality enhances collaborative knowledge management by allowing dynamic content generation based on stored metadata. However, prior to version 7.2.0, the implementation of the Special:URIResolver page contained a critical security flaw related to how it handled user-controlled input during URL resolution processes. The vulnerability stems from the way the resolver interprets subpage arguments provided in the request URI and subsequently constructs redirect targets without adequate validation mechanisms.
The technical core of this vulnerability lies in the handling of interwiki prefixes within the resolved MediaWiki title. When a user requests Special:URIResolver with a specific subpage, such as mw-3AFoo, the system decodes the input to interpret it as an internal wiki reference like mw:Foo. Instead of validating whether the resulting target URL remains within the trusted domain or scope of the local instance, the application issues an HTTP 303 redirect directly to the full URL derived from this title object via getFullURL(). This lack of validation allows attackers to manipulate the authority component of the destination URL. By exploiting interwiki prefixes that map to external domains, such as mediawiki.org or other configured foreign wikis, an attacker can force the application to redirect users away from the trusted environment entirely.
Furthermore, this flaw extends beyond simple domain redirection. The resolved URL structure permits the inclusion of user credentials in the authority section of the URI, formatted as user:pass@host. While modern browsers may strip these credentials for security reasons when navigating cross-origin requests, their presence in the redirect target can still be leveraged in sophisticated phishing campaigns or to confuse users about the true destination of a link. The primary operational impact is an open redirect vulnerability that enables attackers to disguise malicious links as originating from a trusted Semantic MediaWiki instance. This trust exploitation facilitates targeted phishing attacks where victims are lured into entering sensitive information on attacker-controlled sites under the false assumption they remain within the secure wiki environment.
From a classification perspective, this issue aligns with CWE-601, which describes URL Redirection to Untrusted Site (Open Redirect). The attack vector is categorized under ATT&CK technique T1583.002, specifically Acquire Infrastructure: Domains, as it involves leveraging legitimate infrastructure for malicious redirection purposes. It also touches upon CWE-79 if the redirect target were used in conjunction with other injection techniques to capture session tokens or credentials through deceptive interfaces mimicking the original service.
To mitigate this vulnerability, organizations running Semantic MediaWiki must upgrade immediately to version 7.2.0 or later, where the developers have implemented proper validation checks for resolved targets before issuing redirects. Until an upgrade is feasible, administrators should consider implementing web application firewall rules that detect and block requests containing suspicious interwiki prefixes in URI resolver parameters. Additionally, restricting access to Special:URIResolver through authentication requirements can reduce the attack surface by ensuring only authorized users can trigger these resolution processes. Regular security audits of wiki extensions are essential to identify similar logic flaws where user input influences critical navigation flows without sufficient sanitization or validation against expected domains and protocols.