EUVD-2026-17127Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitation of the url parameter. Attackers can craft malicious URLs with javascript: schemes that execute arbitrary JavaScript in victims' browsers when clicked through the unsanitized link.
AnalysisAI
Reflected cross-site scripting (XSS) in Smoothwall Express versions before 3.1 Update 13 allows unauthenticated remote attackers to execute arbitrary JavaScript in users' browsers by crafting malicious URLs with javascript: schemes and delivering them through the unsanitized /redirect.cgi endpoint. The vulnerability requires user interaction (clicking a malicious link) and results in limited scope impact affecting user confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the /redirect.cgi endpoint of Smoothwall Express, a network security appliance platform. The root cause is improper input validation and sanitization of the 'url' parameter (CWE-79: Improper Neutralization of Input During Web Page Generation). When a user is redirected through /redirect.cgi, the application fails to strip or validate the url parameter before reflecting it into the HTTP response, allowing attackers to inject javascript: URI schemes. Modern browsers execute these schemes as client-side scripts with the same origin context as the Smoothwall web interface, potentially compromising session cookies, CSRF tokens, and sensitive configuration data visible to authenticated administrators.
RemediationAI
Vendor-released patch: Smoothwall Express 3.1 Update 13 or later. Administrators should upgrade to the patched version immediately via the official Smoothwall update mechanism documented in the community forum advisory at https://community.smoothwall.org/forum/viewtopic.php?t=45095. No workarounds are documented; patching is the definitive remediation. In the interim, restrict web interface access to trusted networks via firewall rules and educate users about not clicking suspicious redirect links from untrusted sources.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in
Denial of Service vulnerability in Multer (Node.js multipart form-data middleware) affecting versions 1.4.4-lts.1 throug
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Servify Express, a Node.js package for starting Express servers, contains a denial of service vulnerability caused by th
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Ty
Express.js minimalist web framework for node. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitab
The EXPRESS (aka com.gpshopper.express.android) application 2.5.3 for Android does not verify X.509 certificates from SS
Stored cross-site scripting in Smoothwall Express prior to version 3.1 Update 13 allows authenticated attackers to injec
Express.js minimalist web framework for node. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitab
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today