Read the docs
TI-2026-21912 Aliases CVE-2026-27508GHSA-rx2c-j693-rp5c

Smoothwall Express < 3.1 Update 13 Reflected XSS in redirect.cgi via url Parameter

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitation of the url parameter. Attackers can craft malicious URLs with javascript: schemes that execute arbitrary JavaScript in victims' browsers when clicked through the unsanitized link.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Fix Fixed Express (Smoothwall): 3.1 Update 13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SmoothwallExpressbefore 3.1 Update 133.1 Update 13Patch availableCNA
  • Express VendorSmoothwall Affected before 3.1 Update 13 Fixed in 3.1 Update 13 Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:o:smoothwall:smoothwall_express:*:*:*:*:*:*:*:*up to 3.0VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update1:*:*:-:*:*:*3.1 update1VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update10:*:*:-:*:*:*3.1 update10VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update11:*:*:-:*:*:*3.1 update11VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update12:*:*:-:*:*:*3.1 update12VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update2:*:*:-:*:*:*3.1 update2VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update3:*:*:-:*:*:*3.1 update3VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update4:*:*:-:*:*:*3.1 update4VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update5:*:*:-:*:*:*3.1 update5VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update6:*:*:-:*:*:*3.1 update6VulnerableSmoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:*:*:*:*:*:*:*:* Versions up to 3.0 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update1:*:*:-:*:*:* Versions 3.1 update1 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update10:*:*:-:*:*:* Versions 3.1 update10 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update11:*:*:-:*:*:* Versions 3.1 update11 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update12:*:*:-:*:*:* Versions 3.1 update12 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update2:*:*:-:*:*:* Versions 3.1 update2 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update3:*:*:-:*:*:* Versions 3.1 update3 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update4:*:*:-:*:*:* Versions 3.1 update4 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update5:*:*:-:*:*:* Versions 3.1 update5 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update6:*:*:-:*:*:* Versions 3.1 update6 Vulnerable ·Smoothwall
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update7:*:*:-:*:*:*3.1 update7VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update8:*:*:-:*:*:*3.1 update8VulnerableSmoothwall
cpe:2.3:o:smoothwall:smoothwall_express:3.1:update9:*:*:-:*:*:*3.1 update9VulnerableSmoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update7:*:*:-:*:*:* Versions 3.1 update7 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update8:*:*:-:*:*:* Versions 3.1 update8 Vulnerable ·Smoothwall
  • cpe:2.3:o:smoothwall:smoothwall_express:3.1:update9:*:*:-:*:*:* Versions 3.1 update9 Vulnerable ·Smoothwall

Remediation

  • Fix · CNA Express (Smoothwall) Fixed in 3.1 Update 13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Smoothwall Express — community.smoothwall.org/forum/viewtopic.php?t=45095

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-21301 Smoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi via VPN_IP ParameterPriority LOW 22
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27508
  2. 2026-10-03 Alias added: GHSA-rx2c-j693-rp5c

References

Patch 1

  • TI-2019-15448 Smoothwall Express 3.1 'preferences.cgi' Cross-Site Scripting CVSS 4.0MEDIUM 5.3
  • TI-2019-15432 Smoothwall Express 3.1 'urlfilter.cgi' Cross-Site Scripting CVSS 4.0MEDIUM 5.3
  • TI-2019-15445 Smoothwall Express 3.1 'iptools.cgi' Cross-Site Scripting CVSS 4.0MEDIUM 5.1
  • TI-2019-15437 Smoothwall Express 3.1 'portfw.cgi' Cross-Site Scripting CVSS 4.0MEDIUM 5.1
  • TI-2019-15436 Smoothwall Express 3.1 'apcupsd.cgi' Cross-Site Scripting CVSS 4.0MEDIUM 5.1
  • TI-2019-15435 Smoothwall Express 3.1 'time.cgi' Cross-Site Scripting CVSS 4.0MEDIUM 5.1
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences