GHSA-gq27-fc8w-vcmp — admidio/admidio
MEDIUMGHSA-gq27-fc8w-vcmp is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in admidio/admidio. A fix is available for admidio/admidio — see the affected versions and patch details below.
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for GHSA-gq27-fc8w-vcmp.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-gq27-fc8w-vcmp plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 379,145 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
admidio/admidioReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
An unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's browser through a reflected XSS in system/msg_window.php. The endpoint passes user input through htmlspecialchars(), which does not encode square brackets. A subsequent call to Language::prepareTextPlaceholders() converts those brackets into HTML angle brackets, producing executable markup.
Details
The msg_window.php endpoint accepts message_id and message_var1 as GET parameters. At line 146, the code passes message_var1 through htmlspecialchars() before inserting it into the language string as a placeholder:
// system/msg_window.php:146
$messageText = $gL10n->get($messageId, array(htmlspecialchars($messageVar1)));
htmlspecialchars() encodes <, >, &, ", and ' but leaves [ and ] untouched. The Language::get() method calls Language::prepareTextPlaceholders(), which performs a character-level translation:
// src/Infrastructure/Language.php:497
$text = strtr($text, '[]', '<>');
This converts all square brackets in the output string, including those from user input, into angle brackets. An attacker submits [script]alert(document.domain)[/script], which survives htmlspecialchars() unchanged, then becomes <script>alert(document.domain)</script> after placeholder preparation.
The application sets no Content-Security-Policy headers, so inline scripts execute without restriction.
Proof of Concept
Visit the following URL on any Admidio installation (no authentication required):
https://<admidio-host>/system/msg_window.php?message_id=INS_INSTALLATION_VERSION&message_var1=%5Bscript%5Dalert(document.domain)%5B/script%5D
The server responds with an HTML page containing:
Installation version <script>alert(document.domain)</script>
The JavaScript executes in the context of the Admidio origin, displaying the current domain in an alert dialog.
Impact
An attacker crafts a malicious URL and sends it to any Admidio user. When the victim clicks the link, attacker-controlled JavaScript runs in their browser session. The attacker can steal session cookies, perform administrative operations on behalf of the victim, or redirect the victim to phishing pages. The endpoint requires no authentication.
Recommended Fix
Apply output encoding after Language::prepareTextPlaceholders() runs, or stop translating square brackets that originate from user-supplied placeholder values. A targeted fix: escape [ and ] in user input before passing it into Language::get().
Found by aisafe.io
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | admidio/admidio | all versions | 5.0.9composer require admidio/admidio:^5.0.9 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for admidio/admidio, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update admidio/admidio to 5.0.9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gq27-fc8w-vcmp is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-gq27-fc8w-vcmp can be triaged on real exposure rather than presence alone.
Tailored to GHSA-gq27-fc8w-vcmp. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-gq27-fc8w-vcmp in your dependencies?
O3 Security finds GHSA-gq27-fc8w-vcmp across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.