Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows… (CVE-2026-109327)

The vulnerability in Admidio affects versions 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15. It is a reflected cross-site scripting flaw in system/redirect.php, allowing unauthenticated attackers to inject malicious JavaScript via the url GET parameter. This issue arises from an incomplete remediation of CVE-2021-43810. The crafted URL uses a javascript: scheme with a decoy http:// segment to evade validation checks, resulting in script execution in the victim's browser under the Admidio origin upon clicking the malicious redirect link. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the vulnerable Admidio web application. This can result in partial confidentiality and integrity impacts, such as theft of sensitive information or manipulation of web content within the user's session. The vulnerability requires user interaction (clicking a crafted link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is due to an incomplete fix of a previous issue, users should verify if an official patch or update beyond version 5.0.15 is available and apply it promptly. Until a patch is confirmed, avoid clicking suspicious redirect links and consider implementing web application firewall rules to detect and block malicious URL patterns targeting the redirect.php endpoint.