CVE-2026-103048CWE-601

CVE-2026-103048

Medium · published September 30, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.

This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00147 · 3.6th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-09-30T04:16Z
References (2)
https://gerrit.wikimedia.org/r/c/1346083 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://phabricator.wikimedia.org/T321092 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 29 SEP 23:04Z
    Open Redirect in Special:Book
    cvelistv5