# CVE-2026-109327: Admidio reflected XSS in system/redirect.php

Source: https://junglewise.ai/threats/cve-2026-109327-admidio-4-0-12-through-4-3-17-and-5-0-0-before-5-0-15-contains-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109327 · Severity: medium · CVSS 6.1 · Published 2026-10-12

Admidio is a web-based group management system used by organizations to manage memberships and communications. A reflected cross-site scripting vulnerability in the redirect functionality allows attackers to craft malicious links that execute JavaScript in users' browsers when clicked, potentially leading to session hijacking, credential theft, or defacement. The vulnerability affects versions 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 and requires no authentication, but does require a victim to click a malicious link.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio).

## Quick answers

**Is CVE-2026-109327 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109327 being exploited in the wild.

**How severe is CVE-2026-109327?** Medium severity, with a CVSS score of 6.1, published 12 October 2026.

**Which products and versions are affected?** Admidio 4.0.12 through 4.3.17, 5.0.0 before 5.0.15.

**Is there a fix for CVE-2026-109327?** Yes: fixed in Admidio 5.0.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109327 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-109327?** Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Admidio 5.0.15

## Technical details

A reflected XSS vulnerability exists in system/redirect.php due to incomplete validation of the url GET parameter. The parameter is validated using StringUtils::strValidCharacters() and FILTER_VALIDATE_URL, but these checks do not enforce HTTP/HTTPS-only schemes and do not require the scheme to be at the start of the string. An attacker can craft a javascript: URL containing a decoy http:// segment that passes validation and is inserted directly into an HTML <a href> attribute without encoding, allowing arbitrary JavaScript execution in the Admidio origin when a victim clicks the link.

## Affected products

- Admidio Admidio 4.0.12 through 4.3.17, 5.0.0 before 5.0.15

## Timeline

- 2026-09-22: disclosed
- 2026-10-12: advisory

## References

- [https://github.com/Admidio/admidio/security/advisories/GHSA-vxfg-x6vc-7w3w](https://github.com/Admidio/admidio/security/advisories/GHSA-vxfg-x6vc-7w3w)
- [https://www.vulncheck.com/advisories/admidio-4.0.12-through-4.3.17-and-5.0.0-before-5.0.15-reflected-xss-via-system-redirect-php](https://www.vulncheck.com/advisories/admidio-4.0.12-through-4.3.17-and-5.0.0-before-5.0.15-reflected-xss-via-system-redirect-php)

## Related threats

- [Admidio improper access control in event registration](https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control)
- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio broken access control in inventory module](https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio forum topic authorization bypass in ForumService::saveTopic()](https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct)