CVE-2026-97165: Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0

Q: Which deployments are affected?

Event Gallery versions earlier than 6.5.0 are affected. The issue is associated with handling of the return parameter in the extension.

Q: What must an attacker provide to exploit this issue?

An attacker needs to supply a return parameter whose base64-decoded value is used in the Back link. The value is not validated before being written to that link.

Q: What are the possible impacts?

The unvalidated return value can enable reflected cross-site scripting and open redirect behavior through the Back link.

Published Sep 27, 2026

Updated

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated.

Affected Software

1 affected component

svenbluege.de Event Gallery<6.5.0

Event History

Sep 27, 2026

CVE Published

via MITRE·11:44 AM

Data Sourced

via MITRE·11:44 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Event Gallery versions earlier than 6.5.0 are affected. The issue is associated with handling of the return parameter in the extension.

What must an attacker provide to exploit this issue?

An attacker needs to supply a return parameter whose base64-decoded value is used in the Back link. The value is not validated before being written to that link.

What are the possible impacts?