PT-2026-37145 · Admidio · Admidio

Adrgs · Published 2026-04-29 · Updated 2026-05-07 · CVE-2026-41661

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.9

Description An unauthenticated attacker can execute arbitrary JavaScript in a user's browser via reflected Cross-Site Scripting (XSS). The issue occurs in the 'system/msg window.php' endpoint, which accepts message id and message var1 as GET parameters. The application processes message var1 using htmlspecialchars(), which does not encode square brackets. Subsequently, the Language::prepareTextPlaceholders() function converts these square brackets into HTML angle brackets, resulting in executable markup. This allows an attacker to bypass encoding and run scripts in the context of the Admidio origin, potentially leading to session cookie theft or unauthorized administrative operations.

Recommendations Update to version 5.0.9. As a temporary workaround, restrict access to the 'system/msg window.php' endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41661

GHSA-GQ27-FC8W-VCMP

Affected Products

Admidio

References · 8

• 🔥 https://github.com/Admidio/admidio/security/advisories/GHSA-gq27-fc8w-vcmp · Exploit
• https://osv.dev/vulnerability/GHSA-gq27-fc8w-vcmp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41661 · Security Note
• https://github.com/Admidio/admidio · Note
• https://github.com/Admidio/admidio/releases/tag/v5.0.9 · Note
• https://twitter.com/CVEarity/status/2052401533208408454 · Twitter Post
• https://twitter.com/CVEnew/status/2052400847452283239 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052315115853148176 · Twitter Post