CVE-2026-58520

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing.

This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.

References

Affected packages

Git / github.com/wikimedia/mediawiki

Affected ranges

Type

GIT

Repo

https://github.com/wikimedia/mediawiki

Events

Introduced

8216997ffcc956a610635f07044fb9a3b5dda9d9

Fixed

50755a861e6e748cf8bac24e8cdd5e83db018081

Introduced

858ee255edbe0da2ff8152df403cac2dba2c9948

Fixed

a36f3bc851a8ae3377ee5602b7e2a355d59e7b0e

Introduced

99b4a221a98c0ac1531c3f4e31248562833dbc82

Fixed

ea7980d473268e0ef28c64328a1325f8f4e414b6

Database specific

{
    "cpe": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "1.43.0"
        },
        {
            "fixed": "1.43.9"
        },
        {
            "introduced": "1.44.0"
        },
        {
            "fixed": "1.44.6"
        },
        {
            "introduced": "1.45.0"
        },
        {
            "fixed": "1.45.4"
        }
    ]
}

Affected versions

1.*

1.43.0

1.43.1

1.43.2

1.43.3

1.43.4

1.43.5

1.43.6

1.43.7

1.43.8

1.44.0

1.44.2

1.44.3

1.44.4

1.44.5

1.45.0

1.45.1

1.45.2

1.45.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58520.json"