CVE-2026-77609: 
PHP vulnerability analysis and mitigation

CVE-2026-77609 is an open redirect vulnerability in the Special:URIResolver special page of Semantic MediaWiki, a free open-source MediaWiki extension. The flaw affects all versions up to and including 7.1.0 (Composer package mediawiki/semantic-media-wiki) and was originally published on July 18, 2026, with the GitHub Advisory Database entry updated on September 18, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, SMW Advisory).

The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect). Special:URIResolver accepts a user-controlled subpage path, resolves it to a MediaWiki title, and issues an HTTP 303 redirect to $title->getFullURL() without validating whether the resolved target remains on the same host. An attacker can supply a URL-encoded interwiki prefix (e.g., Special:URIResolver/mw-3AFoo, which decodes to mw:Foo) to redirect victims to an arbitrary foreign wiki or, where the resolved URL carries an authority component, embed user:pass@host credentials in the redirect target. No authentication or special privileges are required; only user interaction (clicking a crafted link) is needed (GitHub Advisory, SMW Advisory).

The primary impact is phishing: attackers can craft URLs that appear to originate from a trusted wiki domain but silently redirect victims to attacker-controlled hosts, facilitating credential theft or malware delivery. Additionally, the ability to embed user:pass@host credentials in the redirect target URL may expose those credentials to the destination server via HTTP request headers or browser behavior. Confidentiality and integrity are both rated Low; availability is unaffected (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The EPSS score is 0.0, indicating very low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires no privileges and no special configuration — only that a victim clicks a crafted link — making it low-complexity but dependent on social engineering (GitHub Advisory, Feedly).

1. Identify target wiki: Locate a publicly accessible MediaWiki instance running Semantic MediaWiki ≤ 7.1.0 with Special:URIResolver enabled.
2. Craft malicious subpage path: Construct a URL using an interwiki prefix encoded to bypass naive input checks, e.g., https://victim-wiki.example.org/wiki/Special:URIResolver/mw-3AFoo (where mw-3A URL-decodes to mw:, an interwiki prefix pointing to mediawiki.org, substitutable with any registered interwiki prefix pointing to an attacker-controlled domain).
3. Embed credentials (optional escalation): If the target wiki's interwiki map or URL resolution allows authority components, craft a subpage that resolves to a URL containing user:pass@attacker.example.com to leak credentials to the attacker's server.
4. Distribute phishing link: Send the crafted Special:URIResolver URL to victims via email, chat, or other channels, leveraging the trusted wiki domain to bypass suspicion.
5. Harvest credentials or deliver payload: When the victim clicks the link, the wiki issues an HTTP 303 redirect to the attacker-controlled host, where a phishing page or malware payload can be served (SMW Advisory).

• Network: HTTP 303 redirect responses from Special:URIResolver endpoints pointing to external or unexpected hosts; outbound redirects from the wiki server to domains not in the configured interwiki map.
• Logs: Web server access logs showing requests to /wiki/Special:URIResolver/<encoded-interwiki-prefix> with URL-encoded colons (e.g., -3A) in the subpage path; repeated requests from the same IP to Special:URIResolver with varying encoded prefixes.
• Application Logs: MediaWiki debug logs recording title resolution to off-host interwiki targets followed by getFullURL() calls returning external URLs.

Upgrade Semantic MediaWiki to version 7.2.0 or later, which validates the resolved redirect target URL at the redirect sink — rejecting redirects when a user or pass component is present or when the resolved host does not match the current wiki host (SMW Release, GitHub Advisory). No official configuration-based workaround is documented; the recommended action is to update via Composer (composer require mediawiki/semantic-media-wiki:^7.2.0). Wiki administrators unable to upgrade immediately should consider restricting access to Special:URIResolver via MediaWiki's $wgGroupPermissions or web server rules as a temporary measure.

The vulnerability was reported by researcher krabina and the advisory was published by alistair3149 on the Semantic MediaWiki GitHub repository. No significant broader media coverage or notable public researcher commentary beyond the GitHub advisory has been identified at this time (SMW Advisory).