CVE-2026-77609: Semantic MediaWiki Open Redirect Vulnerability

CVE-2026-77609 Overview

CVE-2026-77609 is an open redirect vulnerability [CWE-601] in Semantic MediaWiki, a free open-source extension to MediaWiki that stores and queries structured data within wiki pages. Versions prior to 7.2.0 expose Special:URIResolver, which resolves a user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to the resolved $title->getFullURL() without validating the target. Attackers can craft subpages that resolve to interwiki targets or URLs containing user:pass@host authority components, redirecting victims to attacker-influenced hosts. The vulnerability is fixed in version 7.2.0.

Critical Impact
Attackers can weaponize trusted wiki URLs to redirect users to arbitrary external hosts, enabling credible phishing campaigns that appear to originate from a legitimate wiki domain.

Affected Products

Semantic MediaWiki versions prior to 7.2.0
MediaWiki installations running the vulnerable Semantic MediaWiki extension
Wiki deployments exposing the Special:URIResolver special page

Discovery Timeline

2026-09-18 - CVE-2026-77609 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-77609

Vulnerability Analysis

The flaw resides in the Special:URIResolver handler in Semantic MediaWiki. The handler accepts a user-controlled subpage, decodes it into a MediaWiki title object, and issues an HTTP 303 redirect to whatever URL $title->getFullURL() returns. No validation confirms that the resolved URL points to the local wiki host.

MediaWiki title resolution supports interwiki prefixes, which map short prefixes to fully-qualified external URLs. A crafted subpage such as Special:URIResolver/mw-3AFoo decodes to mw:Foo and resolves to https://www.mediawiki.org/wiki/Foo. When the resolved URL contains an authority component, an attacker can embed credentials using the user:pass@host syntax, further obscuring the true destination in browser address bars.

Root Cause

The root cause is missing destination validation before issuing a redirect. Special:URIResolver trusts the output of MediaWiki title resolution as a safe redirect target, even though interwiki resolution and URL parsing can produce URLs pointing to arbitrary external authorities. This is a classic instance of [CWE-601] URL redirection to untrusted site.

Attack Vector

An attacker crafts a URL on a trusted wiki that includes an encoded interwiki prefix in the Special:URIResolver subpage. The attacker distributes the link through email, chat, or social media. Victims see a legitimate wiki hostname and follow the link. The wiki responds with an HTTP 303 redirect that sends the victim's browser to an attacker-controlled site, where phishing content or malware delivery can occur.

Exploitation requires user interaction to click the link, but no authentication on the wiki. See the GitHub Security Advisory GHSA-hw3m-8j5x-94ff for the maintainers' technical description.

Detection Methods for CVE-2026-77609

Indicators of Compromise

Web server access logs showing requests to Special:URIResolver/ subpaths containing URL-encoded colons (-3A) or interwiki prefixes.
HTTP 303 responses from the wiki with Location headers pointing to hosts outside the wiki's own domain.
Requests to Special:URIResolver where the resolved target embeds user:pass@ authority components.

Detection Strategies

Parse web server logs for Special:URIResolver requests and cross-reference the resulting Location header against an allowlist of trusted domains.
Alert on any redirect chain that transitions from the wiki's own hostname to an external host via Special:URIResolver.
Use web application firewall (WAF) rules to flag encoded interwiki prefix patterns such as -3A or %3A inside Special:URIResolver paths.

Monitoring Recommendations

Enable verbose access logging on the MediaWiki front-end, capturing full request URIs and response Location headers.
Monitor referrer logs on external systems for inbound traffic redirected from the wiki host.
Track user reports of phishing links that originate from wiki URLs and correlate them with Special:URIResolver access patterns.

How to Mitigate CVE-2026-77609

Immediate Actions Required

Upgrade Semantic MediaWiki to version 7.2.0 or later on all wiki installations.
Audit web server logs for prior exploitation attempts against Special:URIResolver.
Notify wiki users to be cautious of links appearing to originate from the wiki, especially those containing Special:URIResolver in the path.

Patch Information

Semantic MediaWiki version 7.2.0 fixes the issue by validating the resolved redirect target. Administrators should update via their standard MediaWiki extension management process. Release notes are available in the SemanticMediaWiki 7.2.0 release.

Workarounds

If immediate upgrade is not feasible, restrict access to Special:URIResolver through web server rules or MediaWiki configuration until the patch is applied.
Deploy a WAF rule that blocks Special:URIResolver requests containing encoded interwiki prefixes or authority components.
Configure server-side redirect filtering to strip or reject any Location header referencing external hosts on responses from the wiki.

bash

# Example nginx rule to block Special:URIResolver until patched
location ~ ^/wiki/Special:URIResolver/ {
    return 403;
}