CVE-2026-41661: Admidio Reflected XSS Vulnerability

CVE-2026-41661 Overview

CVE-2026-41661 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Admidio, an open-source user management solution. The flaw exists in system/msg_window.php in versions prior to 5.0.9. User input is processed through htmlspecialchars(), which does not encode square brackets. A subsequent call to Language::prepareTextPlaceholders() converts those brackets into HTML angle brackets, producing executable markup. An unauthenticated attacker can craft a malicious URL that, when visited by an Admidio user, executes arbitrary JavaScript in that user's browser context.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in any Admidio user's browser, enabling session theft, credential harvesting, and unauthorized actions on behalf of authenticated users.

Affected Products

Admidio versions prior to 5.0.9
The system/msg_window.php endpoint in vulnerable Admidio installations
Web browsers loading crafted Admidio URLs from authenticated user sessions

Discovery Timeline

2026-05-07 - CVE-2026-41661 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-41661

Vulnerability Analysis

The vulnerability stems from an output encoding bypass in Admidio's message window endpoint. The system/msg_window.php file accepts user-controlled input and passes it to PHP's htmlspecialchars() function. While htmlspecialchars() encodes characters such as <, >, &, and quotes, it does not encode square brackets [ and ]. After this initial encoding, the application invokes Language::prepareTextPlaceholders() on the same string. This helper function transforms square bracket sequences into HTML angle brackets to support template-style placeholders. The transformation reintroduces the < and > characters that htmlspecialchars() was meant to neutralize, yielding executable HTML and JavaScript markup in the response body.

Root Cause

The root cause is improper sequencing of sanitization and template processing. Output encoding occurs before placeholder expansion, allowing the placeholder transformation step to undo the protections provided by htmlspecialchars(). The encoder and the template processor operate on overlapping character sets without coordination, producing a sanitization bypass.

Attack Vector

An attacker crafts a URL targeting system/msg_window.php with a payload that uses square brackets in place of angle brackets to wrap a JavaScript payload. The attacker delivers the URL through phishing, social media, or embedded links. When an Admidio user clicks the link, the server reflects the bracket-encoded payload, the placeholder routine converts brackets to angle brackets, and the browser parses the result as HTML and executes the script. Because the attack requires only user interaction and no authentication, any visitor to the crafted URL is at risk.

The vulnerability is described in prose because no public proof-of-concept code is available. See the GitHub Security Advisory GHSA-gq27-fc8w-vcmp for additional technical details.

Detection Methods for CVE-2026-41661

Indicators of Compromise

HTTP requests to system/msg_window.php containing square bracket sequences such as [script], [img], or [svg] in query parameters
Web server access logs showing reflected payloads with URL-encoded square brackets (%5B and %5D) targeting the message window endpoint
Browser console errors or unexpected outbound requests originating from Admidio pages following user link clicks

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for query strings containing bracket-wrapped HTML tag names directed at Admidio endpoints
Deploy signatures matching reflected XSS patterns where input parameters contain [ followed by known HTML element names
Correlate suspicious GET requests to msg_window.php with subsequent anomalous session activity such as privilege changes or data exports

Monitoring Recommendations

Enable verbose access logging on Admidio web servers and forward logs to a centralized analytics platform
Alert on user-agent and referrer anomalies preceding requests to system/msg_window.php
Monitor authenticated session events for indicators of session hijacking following clicks on external links

How to Mitigate CVE-2026-41661

Immediate Actions Required

Upgrade Admidio to version 5.0.9 or later, which contains the official patch
Audit web server logs for prior exploitation attempts targeting system/msg_window.php
Force a session reset for all Admidio users if exploitation is suspected
Notify users to avoid clicking unsolicited Admidio URLs until the upgrade is complete

Patch Information

The maintainers patched this issue in Admidio 5.0.9. Administrators should download the fixed release from the GitHub Release v5.0.9 page and follow the project's upgrade procedure. Verify the deployment by confirming the installed version string and re-testing the system/msg_window.php endpoint.

Workarounds

Restrict access to system/msg_window.php at the web server or WAF layer until patching is possible
Deploy a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of reflected XSS
Configure WAF rules that reject requests containing square-bracketed HTML tag names in query parameters

bash

# Example nginx rule blocking suspicious bracket-wrapped tags on the vulnerable endpoint
location = /system/msg_window.php {
    if ($args ~* "\[(script|img|svg|iframe|body|onerror|onload)") {
        return 403;
    }
}