PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-97165 svenbluege.de CVE debrief

The CVE-2026-97165 vulnerability is a reflected XSS and open redirect issue in the Event Gallery extension for Joomla, affecting versions less than 6.5.0. The 'return' parameter is base64-decoded and written to the 'Back' link without validation, leading to potential security risks. This issue can allow attackers to execute malicious scripts or redirect users to malicious sites. Defenders should assess exposure and prioritize patching or updating to version 6.5.0 or later. The CVE record and NVD entry provide limited information about the vulnerability, with the primary details coming from the CVE Program and NIST NVD sources. It is essential to verify the version of the Event and

Vendor
svenbluege.de
Product
Event Gallery for Joomla
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-27
Original CVE updated
2026-09-27
Advisory published
2026-09-27
Advisory updated
2026-09-27

Who should care

Defenders responsible for Joomla installations with the Event Gallery extension should assess exposure and prioritize patching or updating to version 6.5.0 or later.

Why it matters

Defenders should care about CVE-2026-97165 because it affects the Event Gallery extension for Joomla, potentially allowing reflected XSS and open redirect attacks. Version 6.5.0 or later is required to address this vulnerability.

  • Potential for reflected XSS attacks
  • Potential for open redirect attacks
  • Need for version verification and patching

Technical summary

The Event Gallery extension for Joomla is vulnerable to reflected XSS and open redirect attacks due to improper validation of the 'return' parameter. This parameter is base64-decoded and written to the 'Back' link without validation, allowing potential attackers to inject malicious scripts or redirect users. The vulnerability affects versions less than 6.5.0, and defenders should prioritize verifying the version in use and applying patches or updates as necessary. The CVE Program and NIST NVD sources provide the primary details about this vulnerability.

Defensive priority

Defenders should prioritize verifying the version of the Event Gallery extension in use and applying patches or updates as necessary to prevent potential XSS and open redirect attacks.

Recommended defensive actions

  • Verify the version of the Event Gallery extension in use
  • Apply patches or updates to version 6.5.0 or later
  • Monitor for potential XSS and open redirect attacks

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary details coming from the CVE Program and NIST NVD sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-97165 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-97165

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-97165 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-97165

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.