6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41661

CVE-2026-41661: Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion

Admidio is an open-source user management solution. Prior to version 5.0.9, an unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's browser through a reflected XSS in system/msg_window.php. The endpoint passes user input through htmlspecialchars(), which does not encode square brackets. A subsequent call to Language::prepareTextPlaceholders() converts those brackets into HTML angle brackets, producing executable markup. This issue has been patched in version 5.0.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41661

CVE-2026-41661:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.8	5.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in Admidio. The root cause lies in the application's internationalization component. The user-facing entry point is system/msg_window.php, which accepts a message_var1 GET parameter. This input is first sanitized with htmlspecialchars, which does not encode square brackets ([ and ]). The sanitized string is then passed as a placeholder to the Admidio\Infrastructure\Language::get() method.

In vulnerable versions (<= 5.0.8), the get method calls Admidio\Infrastructure\Language::prepareTextPlaceholders(). This function's responsibility was to replace placeholders, but it also contained a line of code, return strtr($text, '[]', '<>');, which translated all square brackets in the processed text into HTML angle brackets (< and >).

This sequence of operations allowed an attacker to craft a payload like [script]alert(1)[/script]. The initial htmlspecialchars call would leave it unchanged. However, the subsequent strtr call within prepareTextPlaceholders would transform it into <script>alert(1)</script>, which would then be rendered by the browser, executing the script. The patch, identified in commit a0fe499385c4c2c15d7755f4b42e0003a8933cfa, resolves the issue by removing the unsafe strtr call from the prepareTextPlaceholders function, thus preventing user-supplied input from being converted into executable HTML.

Vulnerable functions

Admidio\Infrastructure\Language::prepareTextPlaceholders

src/Infrastructure/Language.php

In vulnerable versions, this function takes a string that may contain user-controlled input and unconditionally translates square brackets `[]` into HTML angle brackets `<>`. Because this translation happens after `htmlspecialchars` is called on the input, it allows an attacker to bypass XSS protection and inject arbitrary HTML/JavaScript.

Admidio\Infrastructure\Language::get

src/Infrastructure/Language.php

This function serves as the orchestrator for the vulnerability. It accepts user-controlled input (via its `$params` argument) and passes it through to the `prepareTextPlaceholders` method. An exploit would show this function in the call stack as it's responsible for processing the tainted language string.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.