All vulnerabilities
CVE-2026-109327GHSA-vxfg-x6vc-7w3w

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php

Admidio admidio
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.0.15Fixed versionCVE List
Published12 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 5.0.15admidioCVE List
  • 5.0.15admidio/admidio, composerGitHubcomposer require "admidio/admidio:^5.0.15"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript: URL containing a decoy http:// segment that passes validation and executes script in the Admidio origin when victims click the redirect link.

Text from CVE List

Affected versions 4

  • admidioaffected: 4.0.12 through 4.3.17CVE List
  • admidioaffected: 5.0.0 before 5.0.15CVE List
  • admidiounaffected: 5.0.15CVE List
  • admidio/admidio, composer>= 5.0.0, <= 5.0.14GitHub

References 2