CVE-2026-109327
6.1MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Attackers can run arbitrary JavaScript in a victim's session to steal data or hijack accounts. This requires an unauthenticated attacker to trick a user into clicking a crafted redirect link.
Root cause
An incomplete input validation fix in system/redirect.php allows javascript: URLs containing a decoy http:// string to pass URL checks.
Affected systems
Admidio 4.0.12 through 4.3.17, and 5.0.0 before 5.0.15
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade Admidio to version 5.0.15 or later. If upgrading immediately is not possible, block or restrict direct public access to system/redirect.php at your reverse proxy or web server.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript: URL containing a decoy http:// segment that passes validation and executes script in the Admidio origin when victims click the redirect link.