The vulnerability stems from an improper input validation in the UrlShortener extension’s URL handling function, which first applies PHP’s native URL parser and then processes the URL according to the WHATWG standard. Because the two parsers interpret certain syntactic constructs differently, an attacker can craft a short URL that passes PHP’s checks but is parsed differently by the WHATWG validator, allowing the link to redirect to an arbitrary host. The primary impact is an open redirect that can be leveraged for phishing or malware delivery, and the weakness aligns with CWE-20.

The UrlShortener extension is part of Wikimedia Foundation sites. The CVE description does not specify affected versions, so the scope of the vulnerability is unknown. Sites that have not applied the fix documented in Phabricator ticket T418533 should verify whether they are vulnerable.

The EPSS score is below 1 %, indicating a low overall probability of public exploitation, and the vulnerability is not present in the CISA KEV catalog. The CVSS score of 8.8 indicates a high severity risk, underscoring the vulnerability’s potential to significantly undermine user trust and facilitate phishing. Based on the description, it is inferred that an attacker could craft a short URL that passes initial checks but redirects to an arbitrary host, causing a victim clicking the URL to be redirected to a malicious host. The low exploitation probability keeps the immediate risk moderate, yet the potential impact remains high if the extension is widely deployed.