Reflected Cross-Site Scripting Vulnerability in Admidio by Abberline

CVE-2026-109327

What is CVE-2026-109327?

Versions of Admidio from 4.0.12 through 4.3.17 and 5.0.0 prior to 5.0.15 contain a vulnerability that allows unauthenticated attackers to exploit reflected cross-site scripting via the 'system/redirect.php' file. The flaw arises from an incomplete fix for a previously identified vulnerability, resulting in the ability of attackers to craft malicious JavaScript URLs. An attacker may create a specially crafted HTTP request that injects their script when victims interact with the redirect link, potentially enabling various malicious activities including data theft.

References