CVE-2026-61901 identifies an open redirect vulnerability in the Hikashop extension for Joomla. This vulnerability allows attackers to craft URLs that redirect users to untrusted external sites, potentially facilitating phishing or other social engineering attacks. The affected versions include all releases from 1.0.0 through 6.5.1. There is no official patch or remediation guidance published at this time, and no known exploits have been reported in the wild.

The vulnerability enables attackers to redirect users to arbitrary external websites, which can be leveraged for phishing or to trick users into visiting malicious sites. While this does not directly compromise the Joomla system or Hikashop extension itself, it can be used as part of broader social engineering attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on URLs generated by the Hikashop extension and consider implementing additional URL validation or filtering controls if possible.