CVE-2026-109327

Name of the Vulnerable Software and Affected Versions Admidio versions 4.0.12 through 4.3.17 Admidio versions 5.0.0 through 5.0.14

Description A reflected cross-site scripting issue exists in the 'system/redirect.php' endpoint. Unauthenticated attackers can inject JavaScript through the url GET parameter by crafting a javascript: URL that includes a decoy http:// segment to bypass validation. This allows the execution of arbitrary scripts in the Admidio origin when a victim clicks the malicious redirect link.

Recommendations Update Admidio versions 4.0.12 through 4.3.17 to a version where this issue is resolved. Update Admidio versions 5.0.0 through 5.0.14 to version 5.0.15 or later. As a temporary mitigation, restrict access to the 'system/redirect.php' endpoint or avoid using the url parameter in that endpoint.