Semantic MediaWiki, an extension for MediaWiki, allows users to resolve a subpage under Special:URIResolver to a MediaWiki title and then redirects users with an HTTP 303 to that title’s URL. The subpage input is fully user‑controlled and the component does not validate the resolved target. As a result, an attacker can supply a crafted subpage that resolves to an arbitrary external host, even injecting credentials into the URL. The redirect is therefore a classic open‑redirect flaw that can be used to lure legitimate wiki visitors to phishing sites that appear to come from the trusted wiki domain. The weakness is identified as CWE‑601.

Any installation of Semantic MediaWiki older than version 7.2.0 that exposes the Special:URIResolver endpoint is affected. The flaw exists in the core of the extension and is present in all affected releases; the problem was fixed in Semantic MediaWiki 7.2.0, which validates the target before redirecting.

The vulnerability is rated with a CVSS score of 6.1, indicating a moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, though the open‑redirect nature makes it likely that attackers could exploit it via social engineering or malicious links. Because the redirect is performed without validating the resolved target, any user who follows a link to the vulnerable Special:URIResolver page can be redirected to an attacker-controlled host. The condition of exploitation is that the attacker supplies a crafted subpage which the system resolves to a non‑internal target; no additional authentication or privileged access is required for the exploit to succeed.