CVE-2026-41661: msg_window.php · Admidio Vulnerable to Reflected XSS
Affects admidio/admidioSource GCVE Database
Not known to be exploited · CVSS 6.1 Medium : upgrade to 5.0.9 when convenient.
Data as of 27 Oct 2026, 00:07 UTC
- Patch
- Available – fixed in 5.0.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 7 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade admidio/admidio to 5.0.9.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Packagistadmidio/admidio | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
## Summary An unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's browser through a reflected XSS in `system/msg_window.php`. The endpoint passes user input through `htmlspecialchars()`, which does not encode square brackets. A subsequent call to `Language::prepareTextPlaceholders()` converts those brackets into HTML angle brackets, producing executable markup. ## Details The `msg_window.php` endpoint accepts `message_id` and `message_var1` as GET parameters. At line 146, the code passes `message_var1` through `htmlspecialchars()` before inserting it into the language string as a placeholder: ```php // system/msg_window.php:146 $messageText = $gL10n->get($messageId, array(htmlspecialchars($messageVar1))); ``` `htmlspecialchars()` encodes `<`, `>`, `&`, `"`, and `'` but leaves `[` and `]` untouched. The `Language::get()` method calls `Language::prepareTextPlaceholders()`, which performs a character-level translation: ```php // src/Infrastructure/Language.php:497 $text = strtr($text, '[]', '<>'); ``` This converts all square brackets in the output string, including those from user input, into angle brackets. An attacker submits `[script]alert(document.domain)[/script]`, which survives `htmlspecialchars()` unchanged, then becomes `<script>alert(document.domain)</script>` after placeholder preparation. The application sets no Content-Security-Policy headers, so inline scripts execute without restriction. ## Proof of Concept Visit the following URL on any Admidio installation (no authentication required): ``` https://<admidio-host>/system/msg_window.php?message_id=INS_INSTALLATION_VERSION&message_var1=%5Bscript%5Dalert(document.domain)%5B/script%5D ``` The server responds with an HTML page containing: ```html Installation version <script>alert(document.domain)</script> ``` The JavaScript executes in the context of the Admidio origin, displaying the current domain in an alert dialog. ## Impact An attacker crafts a malicious URL and sends it to any Admidio user. When the victim clicks the link, attacker-controlled JavaScript runs in their browser session. The attacker can steal session cookies, perform administrative operations on behalf of the victim, or redirect the victim to phishing pages. The endpoint requires no authentication. ## Recommended Fix Apply output encoding after `Language::prepareTextPlaceholders()` runs, or stop translating square brackets that originate from user-supplied placeholder values. A targeted fix: escape `[` and `]` in user input before passing it into `Language::get()`. --- *Found by [aisafe.io](https://aisafe.io)*