CVE-2026-41661: Admidio/admidio Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gq27-fc8w-vcmp",
  "modified" : "2026-05-08T20:13:52Z",
  "published" : "2026-04-29T21:51:13Z",
  "aliases" : [ "CVE-2026-41661" ],
  "summary" : "Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion",
  "details" : "## Summary\n\nAn unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's browser through a reflected XSS in `system/msg_window.php`. The endpoint passes user input through `htmlspecialchars()`, which does not encode square brackets. A subsequent call to `Language::prepareTextPlaceholders()` converts those brackets into HTML angle brackets, producing executable markup.\n\n## Details\n\nThe `msg_window.php` endpoint accepts `message_id` and `message_var1` as GET parameters. At line 146, the code passes `message_var1` through `htmlspecialchars()` before inserting it into the language string as a placeholder:\n\n```php\n// system/msg_window.php:146\n$messageText = $gL10n->get($messageId, array(htmlspecialchars($messageVar1)));\n```\n\n`htmlspecialchars()` encodes `<`, `>`, `&`, `\"`, and `'` but leaves `[` and `]` untouched. The `Language::get()` method calls `Language::prepareTextPlaceholders()`, which performs a character-level translation:\n\n```php\n// src/Infrastructure/Language.php:497\n$text = strtr($text, '[]', '<>');\n```\n\nThis converts all square brackets in the output string, including those from user input, into angle brackets. An attacker submits `[script]alert(document.domain)[/script]`, which survives `htmlspecialchars()` unchanged, then becomes `<script>alert(document.domain)</script>` after placeholder preparation.\n\nThe application sets no Content-Security-Policy headers, so inline scripts execute without restriction.\n\n## Proof of Concept\n\nVisit the following URL on any Admidio installation (no authentication required):\n\n```\nhttps://<admidio-host>/system/msg_window.php?message_id=INS_INSTALLATION_VERSION&message_var1=%5Bscript%5Dalert(document.domain)%5B/script%5D\n```\n\nThe server responds with an HTML page containing:\n\n```html\nInstallation version <script>alert(document.domain)</script>\n```\n\nThe JavaScript executes in the context of the Admidio origin, displaying the current domain in an alert dialog.\n\n## Impact\n\nAn attacker crafts a malicious URL and sends it to any Admidio user. When the victim clicks the link, attacker-controlled JavaScript runs in their browser session. The attacker can steal session cookies, perform administrative operations on behalf of the victim, or redirect the victim to phishing pages. The endpoint requires no authentication.\n\n## Recommended Fix\n\nApply output encoding after `Language::prepareTextPlaceholders()` runs, or stop translating square brackets that originate from user-supplied placeholder values. A targeted fix: escape `[` and `]` in user input before passing it into `Language::get()`.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "admidio/admidio"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.0.9"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.0.8"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Admidio/admidio/security/advisories/GHSA-gq27-fc8w-vcmp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-41661"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Admidio/admidio"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Admidio/admidio/releases/tag/v5.0.9"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-29T21:51:13Z",
    "nvd_published_at" : "2026-05-07T04:16:29Z"
  }
}