CVE-2026-109327: Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php
Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript: URL containing a decoy http:// segment that passes validation and executes script in the Admidio origin when victims click the redirect link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Admidioto a version that resolves this vulnerability.Fixed in 5.0.15
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are Admidio 4.0.12 through 4.3.17, and Admidio 5.0.0 before 5.0.15. The issue is in system/redirect.php.
Does exploitation require an authenticated account or special configuration?
No authentication is required for an attacker to craft the malicious redirect URL. Exploitation requires a victim to click the attacker-controlled redirect link.
What must an attacker provide to trigger the issue?
The attacker supplies a crafted value in the url GET parameter. The value uses a javascript: URL with a decoy http:// segment to pass validation and execute JavaScript in the Admidio origin.
What is the practical impact if a victim clicks the link?
The attacker-controlled JavaScript executes in the victim's browser under the Admidio origin. The stated impact includes low confidentiality and integrity impact, with no availability impact.