CVE-2026-109327 in Admidio
Summary
by MITRE • 10/12/2026
Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript: URL containing a decoy http:// segment that passes validation and executes script in the Admidio origin when victims click the redirect link.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
Admidio, a widely used open-source community management software, contains a reflected cross-site scripting vulnerability within its system/redirect.php component affecting versions 4.0.12 through 4.3.17 and version 5.0.0 prior to the release of 5.0.15. This flaw represents an incomplete remediation for CVE-2021-43810, indicating that previous security patches failed to adequately address the underlying input validation logic. The vulnerability allows unauthenticated attackers to inject malicious JavaScript code into web pages viewed by users who interact with specially crafted links. Because the application processes user-supplied data in the url GET parameter without sufficient sanitization or encoding, it becomes a vector for client-side attacks that can compromise user sessions and sensitive data stored within the Admidio environment.
The technical mechanism of this exploit relies on bypassing existing input filters by utilizing a specific URL structure designed to evade detection rules. Attackers construct a javascript: URI scheme containing a decoy http:// segment, which satisfies basic protocol validation checks while ultimately triggering script execution in the context of the Admidio origin when the victim clicks the redirect link. This technique exploits how browsers interpret and resolve different URI schemes, allowing malicious payloads to bypass server-side restrictions that typically block direct HTTP redirections or simple XSS strings. The reflected nature of this cross-site scripting means the payload is not stored on the server but is instead delivered via a URL crafted by the attacker, requiring social engineering tactics such as phishing emails or deceptive links to trigger execution in the victim's browser.
The operational impact of this vulnerability extends beyond mere script injection, potentially leading to session hijacking, credential theft, and unauthorized actions performed under the guise of legitimate users. Since Admidio often manages sensitive community data including personal information, event registrations, and administrative controls, successful exploitation can result in significant privacy breaches and integrity compromises. Attackers with basic web development knowledge can automate this process using phishing campaigns or malicious websites that redirect victims to the vulnerable endpoint. The lack of authentication requirements for exploiting this flaw makes it particularly dangerous as any visitor to a compromised link is susceptible regardless of their privilege level within the application, although higher-privileged users may face more severe consequences if their sessions are hijacked.
Mitigation strategies should prioritize immediate patching by upgrading Admidio to version 5.0.15 or later where this incomplete fix has been properly addressed. In environments where updating is not immediately feasible, administrators can implement web application firewall rules to detect and block requests containing javascript: schemes combined with http:// decoys in the url parameter. Additionally, enforcing strict Content Security Policy headers that restrict script execution origins can mitigate the impact of successful injection attempts by preventing unauthorized scripts from running within the Admidio domain. Input validation should be strengthened on both client and server sides to ensure all redirect parameters are validated against a whitelist of allowed domains or properly encoded before being processed by the application logic, thereby neutralizing similar bypass techniques in future updates.