CVE-2026-58518: Mediawiki RedirectManager Extension CSRF Vulnerability – Analysis & Patch Guidance

Technical summary

The RedirectManager Extension for Mediawiki contains a CSRF vulnerability (CWE-352) that fails to properly validate the origin of state-changing requests. An attacker can craft a malicious webpage or email containing a forged request that, when accessed by an authenticated Mediawiki user, executes actions on the target wiki instance without proper anti-CSRF token validation. The vulnerability requires user interaction (the victim must visit the attacker-controlled page while logged into the vulnerable Mediawiki instance) but does not require authentication from the attacker's perspective. The network attack vector and low attack complexity indicate the flaw is straightforward to exploit once a victim is lured to the malicious content.

Business impact

Organizations running Mediawiki with the RedirectManager Extension may experience uncontrolled modification of redirects, which could be leveraged to conduct phishing attacks, deface content, or redirect users to malicious external sites. If the affected user possesses administrative privileges, the impact escalates significantly—attackers could modify wiki configuration, user permissions, or content at scale. For public wikis or those handling sensitive organizational knowledge, this represents a reputational and operational risk. The attack requires social engineering to succeed, making staff awareness and technical controls equally important.

Affected systems

The vulnerability specifically affects Mediawiki installations with the RedirectManager Extension versions prior to 1.3.3. Any Mediawiki deployment using this extension without the patch is vulnerable. The scope is limited to the extension itself; the core Mediawiki application is not affected. Organizations should audit their extension inventory and version control to identify affected instances.

Exploitability

The vulnerability has a CVSS 3.1 base score of 6.3 (MEDIUM severity) with network accessibility and low attack complexity, making it relatively straightforward to exploit. However, it is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been documented at the time of publication. Success depends on user interaction—an attacker must socially engineer a victim into visiting a malicious page while the victim maintains an active authenticated session on the target Mediawiki. The attack does not require special privileges or advanced technical capabilities beyond basic web application exploitation techniques.

Remediation

Upgrade the RedirectManager Extension to version 1.3.3 or later. Organizations should verify the current version in their Mediawiki installation and prioritize patching given the ease of exploitation and potential for abuse by authenticated attackers or through social engineering. Apply the patch during a maintenance window to minimize disruption.

Patch guidance

1. Identify all Mediawiki instances running the RedirectManager Extension by reviewing LocalSettings.php or your extension management system. 2. Back up your Mediawiki database and configuration before upgrading. 3. Update the RedirectManager Extension to version 1.3.3 or the latest available version from the official Wikimedia repository. 4. Verify the upgrade by checking the extension version in Special:Version within the Mediawiki admin panel. 5. Clear any cached content and test redirect functionality in a non-production environment first if possible. 6. Document the patch date and version for compliance and audit purposes.

Detection guidance

Monitor your Mediawiki logs for unusual redirect modifications, especially those originating from external referrers or anomalous user agents. Look for POST requests to redirect-related endpoints lacking proper Referrer headers or originating from unfamiliar domains. Implement intrusion detection rules that flag requests to sensitive Mediawiki actions (edit, redirect creation/modification) without expected anti-CSRF tokens. Web application firewalls can be configured to require strict referer validation for state-changing requests. Consider enabling detailed audit logging on redirect changes to correlate modifications with user sessions and IP addresses.

Why prioritize this

While the CVSS score is MEDIUM (6.3), this vulnerability warrants prioritization because: (1) the attack vector is network-accessible with low complexity, making it practical to exploit; (2) it can lead to unauthorized content modification and potential phishing attacks; (3) patches are readily available; and (4) remediation is straightforward for organizations maintaining their extensions. The absence from the KEV catalog suggests a window of opportunity to patch before widespread exploitation develops.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a MEDIUM-severity impact. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) indicates network accessibility, low attack complexity, no attacker privileges required, user interaction required, and limited impact to confidentiality, integrity, and availability within the affected component. The 'UI:R' requirement for user interaction prevents a higher score, but the ease of crafting social engineering attacks and the potential for redirect manipulation in public-facing wikis justify MEDIUM severity for most organizations.

Frequently asked questions