The Mediawiki UrlShortener Extension contains a CWE-601 open redirect vulnerability that permits attackers to redirect users to untrusted external sites. This can be leveraged for Cross-Site Flashing attacks. The vulnerability affects all versions before 1.43.9, 1.44.6, and 1.45.4. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow attackers to redirect users to malicious websites, potentially leading to phishing or other social engineering attacks. The vulnerability may also facilitate Cross-Site Flashing, which can impact user trust and security. However, no direct code execution or privilege escalation is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when handling URLs generated by the UrlShortener Extension and consider implementing additional validation or filtering on redirect targets if possible.