CVE-2026-115537: gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routingpages.php of the component URL Validation. This manipulation of the argument urlroute causes open redirect. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges, but it requires user interaction. An attacker would need to induce a user to follow or interact with a crafted redirect using the manipulated url_route argument.
Which deployments should be treated as potentially affected?
gedelumbung HospitalManagement deployments containing the affected simpan function in application/modules/admin/controllers/routing_pages.php should be treated as potentially affected. The available information identifies affected code through commit c2d45543789a3887067d3915f69d44cfc2cf76a8; no affected or fixed release versions are available because the project uses a rolling release.
Is a public exploit available?
Yes. Exploit information has been made public, so the issue could be used in attacks.
Is a vendor fix available?
No updated release details are available. The project was notified through an issue report but had not responded at the time of the report.