UrlShortener, the Wikimedia Foundation’s URL shortening extension, relies on PHP’s native URL parser for input validation while also applying the WHATWG URL standard in a separate phase. The two validation mechanisms do not agree, creating a gateway for attackers to construct a URL that passes PHP’s check but is interpreted differently by the WHATWG validator. This input‑validation flaw (CWE‑20) permits an attacker to embed a short link that redirects recipients to any chosen host, facilitating phishing or malware delivery without user knowledge.

The vulnerability affects the UrlShortener extension on Wikimedia Foundation sites. Any installation that has not applied the fix documented in Phabricator ticket T418533 may be vulnerable. Specific release numbers are not furnished in the advisory, so all prior versions of the extension can be considered at risk until updated.

The EPSS score is below 1 %, and the vulnerability is absent from the CISA KEV list, indicating no known public exploitation. Although a precise CVSS score is unavailable, the ability to redirect users to arbitrary destinations presents a serious threat to user trust and security. An attacker must craft a shortened link that the extension accepts; when a user clicks it, they will be sent to a malicious host. The low exploitation probability keeps the risk moderate, yet the potential impact remains high if the extension is widely deployed.