Skip to content
CVE IDCVE-2026-77609GitHub advisory IDGHSA-hw3m-8j5x-94ff

Semantic MediaWiki has an open redirect in Special:URIResolver

CVE-2026-77609 (GitHub advisory GHSA-hw3m-8j5x-94ff) is a medium-severity vulnerability with a CVSS 3.1 base score of 6.1, classed as URL Redirection to Untrusted Site ('Open Redirect') (CWE-601), in mediawiki/semantic-media-wiki (Packagist). Affected versions: <= 7.1.0. It is fixed in 7.2.0.

Medium6.1Fix availableGitHub reviewed

Published 18 Sept 2026Updated 18 Sept 2026

6.1MediumCVSS 3.1
CVE ID
CVE-2026-77609
GHSA ID
GHSA-hw3m-8j5x-94ff
EPSS
0.14%higher than 4% of CVEs
Weakness (CWE)
  • CWE-601URL Redirection to Untrusted Site ('Open Redirect')
KEV status
Not in KEV
Published
18 Sept 2026
Updated
18 Sept 2026
Ecosystem
  • Packagist (PHP)
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

Failure mode

Special:URIResolver resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to $title->getFullURL() without validating the resolved target. A crafted subpage can make that target point off-host: an interwiki prefix redirects to the foreign wiki (for example Special:URIResolver/mw-3AFoo, which decodes to mw:Foo, redirects to https://www.mediawiki.org/wiki/Foo), and where the resolved URL carries an authority the target can even embed user:pass@host credentials. The result is an open redirect to an attacker-influenced host, usable for phishing from a trusted wiki URL.

Remediation

  • The resolved target URL is parsed and compared against the current host at the redirect sink.
  • The redirect is rejected (bad-title error page) when a user or pass component is present, or when the host does not match the current host.

Maintenance note

Redirect code must validate the final target URL, not just the input path. Host comparison belongs at the redirect sink: each sink (special page, entry point) must validate its own target rather than relying on upstream normalisation.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Medium6.1Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
Required
Scope S
Changed
Confidentiality C
Low
Integrity I
Low
Availability A
None

Affected packages

Source: OSV (GitHub advisory)

  • mediawiki/semantic-media-wiki
    Packagist (PHP)
    pkg:composer/mediawiki/semantic-media-wiki
    Affected versions
    <= 7.1.0
    Fixed in
    7.2.0
    Show 78 listed versions
    • 1.9
    • 1.9-RC1
    • 1.9.0.1
    • 1.9.0.2
    • 1.9.1
    • 1.9.1.1
    • 1.9.2
    • 1.9beta1
    • 2.0
    • 2.0-RC1
    • 2.0-RC2
    • 2.0-RC3

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 7.2.0 or later.

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • 0d11c07Release commit7.2.0github.com/semanticmediawiki/semanticmediawiki

Vulnerability intelligence

References

Credits

Questions about CVE-2026-77609

What is the GHSA ID for CVE-2026-77609?
GitHub tracks CVE-2026-77609 as GHSA-hw3m-8j5x-94ff.
What is the CVSS score of CVE-2026-77609?
CVE-2026-77609 has a CVSS 3.1 base score of 6.1 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Which versions are affected by CVE-2026-77609?
mediawiki/semantic-media-wiki (Packagist): <= 7.1.0.
How do I fix CVE-2026-77609?
Upgrade to 7.2.0 or later.
What is the Package URL (PURL) for CVE-2026-77609?
The affected package's PURL is pkg:composer/mediawiki/semantic-media-wiki.
Is CVE-2026-77609 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-77609. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 4% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 5 days ago (8 Oct 2026, 19:13 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.