CVE-2026-41661: 
PHP vulnerability analysis and mitigation

CVE-2026-41661 is a reflected Cross-Site Scripting (XSS) vulnerability in Admidio, an open-source user management solution, affecting all versions up to and including 5.0.8. The flaw exists in system/msg_window.php and allows an unauthenticated attacker to execute arbitrary JavaScript in any Admidio user's browser by crafting a malicious URL. It was discovered by aisafe.io, published to the GitHub Advisory Database on April 29, 2026, and assigned a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Admidio Advisory).

The root cause (CWE-79) lies in a two-stage processing pipeline in msg_window.php. At line 146, the message_var1 GET parameter is sanitized with PHP's htmlspecialchars(), which encodes <, >, &, ", and ' but leaves square brackets ([ and ]) untouched. Subsequently, Language::get() calls Language::prepareTextPlaceholders() in src/Infrastructure/Language.php at line 497, which performs a character-level translation via strtr($text, '[]', '<>'), converting all square brackets — including those from user input — into HTML angle brackets. An attacker submits [script]alert(document.domain)[/script] as message_var1, which passes through htmlspecialchars() unchanged and is then rendered as executable <script>alert(document.domain)</script> in the response. The absence of Content-Security-Policy headers further enables unrestricted inline script execution (Admidio Advisory, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's Admidio session without any authentication. This can result in session cookie theft, unauthorized administrative actions performed on behalf of the victim, and redirection to phishing pages. The scope change in the CVSS score reflects that the attacker's script runs in the victim's browser context, potentially affecting resources beyond the vulnerable endpoint itself (GitHub Advisory).

A public proof-of-concept URL is included in the official security advisory, making exploitation trivial for any attacker. No authentication is required, and the attack complexity is low — the attacker only needs to craft a malicious URL and socially engineer a victim into clicking it. The EPSS score is approximately 0.087% (25th percentile), indicating a currently low but non-negligible probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible Admidio installations running version 5.0.8 or earlier using search engines (e.g., Google dork: inurl:"system/msg_window.php") or web application scanners.
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with a square-bracket-encoded script payload in the message_var1 parameter:

   https://<admidio-host>/system/msg_window.php?message_id=INS_INSTALLATION_VERSION&message_var1=%5Bscript%5Dalert(document.cookie)%5B/script%5D

3. Deliver the payload: Send the crafted URL to a target Admidio user via email, chat, or other social engineering channels. No authentication is required on the attacker's side.
4. Victim interaction: When the victim clicks the link, the server processes message_var1 through htmlspecialchars() (square brackets survive) and then Language::prepareTextPlaceholders() converts [script] to <script>, rendering the payload as executable HTML.
5. JavaScript execution: The injected script runs in the victim's browser under the Admidio origin, enabling the attacker to steal session cookies, exfiltrate data, perform admin actions, or redirect the user to a phishing site (Admidio Advisory).

• Network: HTTP GET requests to /system/msg_window.php containing URL-encoded square brackets in the message_var1 parameter (e.g., %5B, %5D, or literal [, ]); unusual outbound connections from victim browsers to attacker-controlled domains following access to the endpoint.
• Logs: Web server access logs showing requests to msg_window.php with message_var1 values containing %5Bscript%5D, [script], or other HTML tag patterns; referrer headers pointing to external or unexpected origins.
• File System: No server-side file artifacts are expected for this reflected XSS; however, if the attacker uses the XSS to deliver a secondary payload, look for unexpected files in the Admidio upload or temp directories.
• Application Behavior: Admidio admin accounts performing unexpected actions (e.g., new user creation, privilege escalation, configuration changes) shortly after a user accessed a suspicious msg_window.php URL (Admidio Advisory).

Admidio has patched this vulnerability in version 5.0.9, released April 18, 2026. The recommended fix is to apply output encoding after Language::prepareTextPlaceholders() runs, or to escape [ and ] in user-supplied input before passing it into Language::get(). Administrators should upgrade to v5.0.9 immediately; the release notes explicitly note it addresses security vulnerabilities and strongly recommend updating. As a temporary workaround where upgrading is not immediately possible, consider blocking external access to system/msg_window.php via web server rules or WAF policies that reject requests with square brackets in the message_var1 parameter (Admidio Advisory, Admidio v5.0.9 Release).

The vulnerability was discovered and reported by aisafe.io, with credit also given to reporter adrgs. The Admidio maintainer (Fasse) published the advisory and patched release promptly. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (Admidio Advisory).