EUVD-2026-46084
GHSA-vr3h-j7mq-24mm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered redirect requires no privileges but mandates victim click; scope changes as the redirect crosses to an attacker-controlled external domain, with partial confidentiality and integrity loss at that destination.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
3DescriptionCVE.org
The Joomla extension Hikashop is vulnerable to an open redirect.
AnalysisAI
Open redirect in Hikashop, the Joomla e-commerce extension, affects all versions from 1.0.0 through 6.5.1 and allows remote unauthenticated attackers to craft legitimate-looking store URLs that silently forward victims to arbitrary external destinations. Exploitation requires victim interaction (a clicked link), making this a phishing and credential-harvesting enabler rather than a direct infrastructure threat. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at just 0.13% (3rd percentile), consistent with SSVC's classification of exploitation status as none.
Technical ContextAI
Hikashop is a widely used e-commerce extension for the Joomla CMS, providing shopping cart, checkout, and product catalog functionality. CWE-601 (URL Redirection to Untrusted Site) occurs when server-side code accepts attacker-controlled input - typically a redirect or return-URL parameter - and uses it to issue an HTTP redirect response without validating that the destination falls within a trusted domain set. The CVSS Scope:Changed (S:C) metric confirms that the security impact crosses from the Hikashop-hosted Joomla origin to the attacker's external domain, which is the defining characteristic of an open redirect: the trusted brand is used as a transparent pass-through. No CPE string was included in the source data, but the affected product is confirmed as the Hikashop Joomla extension versions 1.0.0 through 6.5.1 per EUVD-2026-46084.
RemediationAI
Upgrade Hikashop to the first release beyond version 6.5.1 - consult the vendor changelog at https://www.hikashop.com/ to identify the exact patched version, as no specific fixed release number was confirmed in the available data. As a compensating control while awaiting the patch, configure a Web Application Firewall rule to detect and block redirect-parameter values in Hikashop request paths that point to off-domain destinations (e.g., any value not matching the store's own hostname). Note that overly broad WAF rules may disrupt legitimate post-login or post-checkout return-URL flows, requiring careful testing and allowlisting of expected internal redirect targets. Additionally, ensure that outbound email communications to customers clarify that the store will never redirect them to external login pages, reducing the effectiveness of phishing campaigns that exploit this flaw.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today