Admidio · Admidio · CVE-2026-109327
**Name of the Vulnerable Software and Affected Versions**
Admidio versions 4.0.12 through 4.3.17
Admidio versions 5.0.0 through 5.0.14
**Description**
A reflected cross-site scripting issue exists in the 'system/redirect.php' endpoint. Unauthenticated attackers can inject JavaScript through the `url` GET parameter by crafting a javascript: URL that includes a decoy http:// segment to bypass validation. This allows the execution of arbitrary scripts in the Admidio origin when a victim clicks the malicious redirect link.
**Recommendations**
Update Admidio versions 4.0.12 through 4.3.17 to a version where this issue is resolved.
Update Admidio versions 5.0.0 through 5.0.14 to version 5.0.15 or later.
As a temporary mitigation, restrict access to the 'system/redirect.php' endpoint or avoid using the `url` parameter in that endpoint.