CVE-2026-97165 describes a vulnerability in the Event Gallery extension for Joomla (versions 1.0.0 to 6.0.0) where the 'return' parameter is base64-decoded and directly written to a 'Back' link without validation. This leads to an open redirect (CWE-601) and reflected XSS (CWE-79) vulnerability. The CVSS 4.0 base score is 5.3 (medium severity), with network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

An attacker can craft a URL that causes users to be redirected to untrusted external sites, potentially facilitating phishing or other social engineering attacks. The reflected XSS aspect could allow injection of malicious scripts in the context of the vulnerable site. However, the impact is limited by the need for user interaction and the low impact on confidentiality, integrity, and availability.

No official patch or fix information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking suspicious links containing the 'return' parameter or consider disabling the affected extension if feasible.