Event Gallery CVE-2026-97165

Exploitation requires an attacker to lure a victim into clicking a specially crafted URL against a site running Event Gallery for Joomla before version 6.5.0, where the 'return' parameter is supplied as a base64-encoded value. The extension decodes that value and writes it into the 'Back' link without validation, enabling both open-redirect and reflected-XSS behavior. Limiting factors: user interaction is mandatory (UI:P in the vector) - the attack cannot fire without the victim visiting the malicious link - and it is confined to client-side impact (reflected, not stored), so there is no server-side code execution or persistence; the specific vulnerable extension must be installed on the target Joomla site.

This is a moderate, low-priority issue that combines reflected XSS with an open redirect (CWE-601) in a third-party Joomla extension. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, score 5.3) indicates a network-reachable, unauthenticated attack of low complexity that requires victim interaction (a passive/active click on a crafted link) and yields only low confidentiality/integrity/availability impact - consistent with a reflected client-side flaw rather than server compromise. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the intelligence, so this is not confirmed as actively exploited. The signals are internally consistent (no conflict between vector and description), so the realistic risk is limited to phishing/session-token theft or credential-harvesting redirects against users tricked into clicking attacker links - a real but not urgent concern. Bottom line: genuine, low-severity issue best treated as routine patching, not an emergency.

An attacker crafts a link to a vulnerable Event Gallery page with a base64-encoded 'return' parameter containing either a malicious external URL or a JavaScript/HTML payload, then delivers it to a victim via phishing email or a malicious page. When the victim clicks and the extension decodes the value into the 'Back' link without validation, the browser either follows the attacker-controlled redirect (open redirect for credential phishing) or executes the injected script in the site's context (reflected XSS for session/cookie theft). No public exploit code was identified at time of analysis, but the technique is trivial to reproduce.