EUVD-2026-92453
GHSA-r52h-f94x-72vr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious share link with script/URL payload
-
DeliveryDeliver link to victim via email or chat
-
ExploitVictim opens share mini page
-
ExecutionUnescaped article address executes in browser
-
ImpactHijack session or redirect to attacker site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the 'Share article links' option to be enabled so the share mini page renders the article address; the stored/reflected address is printed without validation or output encoding. Full redirect-without-interaction behavior additionally requires the link type to be set to 'Image Page with Redirect'. A victim must open the attacker-prepared share link (UI:P), so this cannot be triggered server-side or against a victim who never clicks. Affected versions are Event Gallery for Joomla below 6.6.0; impact is confined to the visitor's browser session with no server-side read or write. |
| Impact | This is a client-side vulnerability (reflected XSS plus open redirect) in the Joomla Event Gallery extension's front-end 'share mini page'. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N, base 5.3 MEDIUM) is internally consistent with the description: network-reachable, low complexity, no privileges, but requiring victim interaction (UI:P) to open a crafted link. Impact is limited to the visitor's own browser session - the description explicitly states 'Nothing on the server is changed or read by the server,' which aligns with the absence of subsequent-system impact (SC:N/SI:N/SA:N). No EPSS score, KEV listing, or POC is present in the input, so there is no public exploit identified at time of analysis, and exploitation would be targeted social-engineering rather than automatable mass exploitation. Note a signal conflict: the CWE is CWE-352 (CSRF) and the Tags include 'CSRF', but the description describes reflected cross-site scripting and open redirect, with no state-changing forged request - the CWE/tag appears inconsistent with the narrative and should be verified against the vendor advisory. Overall this is a genuine but moderate, interaction-dependent, low-impact issue, not a high-urgency priority. |
| Exploit ScenarioDerived | An attacker crafts a malicious share link for an image whose embedded article address contains a script payload (or a hostile external URL) and sends it to a victim via email, chat, or a forum post. When the victim opens the share mini page, the unescaped article address is printed into the page and executes script in the victim's session - or, with link type 'Image Page with Redirect', immediately sends the victim to an attacker-controlled site. No public exploit code is identified at time of analysis, but the technique is trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Reflected cross-site scripting and an open redirect in the front-end "share mini page" of the Joomla Event Gallery extension (svenbluege.de) affect all versions below 6.6.0. When the "Share article links" option is enabled, the article address carried in a crafted share link is rendered into the page without validation or output encoding, and when the link type is set to "Image Page with Redirect" the address is followed immediately, allowing an attacker to execute script in the browser session of any visitor who opens the prepared link or to silently redirect that visitor to an attacker-controlled site. The vulnerability is unauthenticated remote (CVSS 4.0 base 5.3; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), requires a victim to click the malicious link, and no public exploit code has been identified at time of analysis; there is no server-side read or write, so impact is confined to the victim's browser session.
RemediationAI
Upgrade the Event Gallery for Joomla extension to version 6.6.0 or later, which is the fixed version boundary indicated by the advisory's "< 6.6.0" affected range - the only reference supplied is the vendor site at https://www.svenbluege.de/, so obtain the patched package there (or via the Joomla extension update mechanism) and verify the installed manifest version afterwards rather than assuming an update succeeded. If the extension cannot be updated immediately, the two configuration-level mitigations map directly to the exploitation prerequisites: turn off the "Share article links" option, which stops the article address from being rendered on the share mini page and removes the XSS injection point (trade-off: shared-image previews will no longer include links back to the originating article), and avoid the "Image Page with Redirect" link type, which removes the automatic redirect behavior (trade-off: shared links will land on the image page without forwarding, which may break intended sharing workflows). Both are effective because the vulnerable code path only executes when these options are active, but they are configuration-dependent and will silently reappear on any configuration reset, so an upgrade remains the durable fix; additionally, output filtering at the web tier (for example a perimeter WAF rule blocking script-bearing parameters on the extension's share endpoint) can provide interim coverage, though it is bypassable and should not be treated as a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the extension's front-end share component, the "share mini page" that renders a preview for an image link that a user shares. Two capabilities combine: the page reads the article address embedded in the incoming share URL and prints it into the HTML output without escaping (reflected XSS), and, for the "Image Page with Redirect" link type, it honors that address as a navigation target (open redirect). The enabling conditions are configuration-dependent - the "Share article links" option must be on for the article address to be rendered, and the "Image Page with Redirect" link type must be active for the immediate redirect behavior. Only the affected product is identified by CPE cpe:2.3:a:svenbluege.de:event_gallery_for_joomla:*:*:*:*:*:*:*:* (all versions prior to 6.6.0). Note that the CWE recorded with this CVE is CWE-352 (Cross-Site Request Forgery), which does not match the described and independently assessed behavior; the underlying weaknesses are classically CWE-79 (improper neutralization of input during web page generation, for the script execution) and CWE-601 (URL redirection to untrusted site). Because the injected value is reflected from the attacker-supplied link rather than stored server-side, the exploit is a pure client-side attack on the victim's session: the server neither reads nor modifies data as a result of the request, and the CVSS 3.1 assessed scope change (S:C) reflects that the impact crosses into the victim's browser context rather than the vulnerable component itself.
Know when Open Redirect gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Reflected XSS reachable over the network with no privileges but requiring the victim to open a crafted link (UI:R); script executes in the browser security context (S:C) with low confidentiality/integrity impact and no availability loss.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front end) can link the article the image was shared from when the option "Share article links" is on. It took the address of the article from the shared link and printed it into the page without checking or escaping it; with the link type "Image Page with Redirect" it followed the address at once. A prepared link could therefore run a script in the page, in the session of the visitor who opened it, or send the visitor to another web site. Nothing on the server is changed or read by the server.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a r
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Exploit-DB