CVE-2026-27508

MEDIUM5.4

Smoothwall Express < 3.1 Update 13 Reflected XSS in redirect.cgi via url Parameter

Published Mar 30, 2026

Modified 1 weeks ago

Details

Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitation of the url parameter. Attackers can craft malicious URLs with javascript: schemes that execute arbitrary JavaScript in victims' browsers when clicked through the unsanitized link.

References

ADVISORY

https://community.smoothwall.org/forum/viewtopic.php?t=45095

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-27508

ADVISORY

https://www.vulncheck.com/advisories/smoothwall-express-reflected-xss-in-redirect-cgi-via-url-parameter

CVSS Analysis

CVSS v4.0

5.1

Exploitability

Attack Vector