Admidio CVE-2026-109327

Exploitation requires an attacker to lure a logged-in or visiting Admidio user into clicking a crafted link to system/redirect.php whose url GET parameter contains a javascript: scheme with an embedded decoy http:// segment that defeats the post-CVE-2021-43810 validation. No authentication is required of the attacker (PR:N), but successful exploitation is strictly gated on victim user interaction (UI:A) - the redirect link must be clicked. It is limited to Admidio instances running versions 4.0.12 through 4.3.17 or 5.0.0 through 5.0.14; version 5.0.15 and later contain the corrected validation.

This is a reflected cross-site scripting flaw whose real-world risk is moderate and bounded by its dependency on victim interaction. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms a network-reachable, low-complexity, unauthenticated issue that nonetheless REQUIRES the victim to click an attacker-supplied redirect link (UI:A), and impact is confined to the subsequent system (SC:L/SI:L, with VC/VI/VA:N) - i.e. the victim's session in the Admidio origin, not the server itself. The base score of 5.1 reflects this limited, interaction-gated impact rather than a critical server compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so there is no public exploit identified at time of analysis; the only exploitation signals are the vendor/VulnCheck advisories describing the technique. A notable contextual signal is that this is explicitly an incomplete fix for CVE-2021-43810, meaning the javascript:-URL-with-http://-decoy bypass defeats an existing sanitization control - reflected XSS in a known redirect endpoint with a documented bypass raises the plausibility of opportunistic weaponization, but absence of KEV/EPSS data suggests this is not currently subject to widespread automated exploitation. Overall: a legitimate patch-worthy issue, not an emergency.

An attacker crafts a malicious URL to system/redirect.php containing a javascript: payload with an embedded decoy http:// segment that passes the endpoint's validation, then distributes it via phishing email, forum post, or chat to Admidio users. When a victim clicks the link, the script executes in the Admidio origin, enabling session cookie theft, CSRF token exfiltration, or actions performed as the victim. No public exploit code is identified at time of analysis, but the bypass technique is fully described in the vendor advisory.