The Mediawiki UrlShortener Extension contains a CWE-601 open redirect vulnerability that permits attackers to redirect users to untrusted external URLs. This can facilitate cross-site flashing attacks by leveraging the redirection mechanism. The vulnerability affects all versions before 1.43.9, versions from 1.43.9 up to but not including 1.44.6, and versions from 1.44.6 up to but not including 1.45.4. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to low impact on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows an attacker to redirect users to arbitrary, potentially malicious external websites via the UrlShortener Extension. This can lead to phishing, social engineering, or other attacks leveraging user trust in the Mediawiki domain. The impact is rated medium due to the potential for user deception but does not directly compromise system confidentiality, integrity, or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the UrlShortener Extension to prevent exploitation. Monitor official Wikimedia Foundation channels for updates and patches addressing this vulnerability.