CVE-2026-27508— Smoothwall Express < 3.1 Update 13 Reflected XSS in redirect.cgi via url Parameter
Quick assessment
Affected
Smoothwall Express
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Smoothwall Express是Smoothwall开源的一个基于GNU/Linux的防火墙操作系统。 Smoothwall Express 3.1 Update 13之前版本存在跨站脚本漏洞，该漏洞源于对url参数清理不当，可能导致反射型跨站脚本攻击。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Smoothwall | Express | < 3.1 Update 13 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-27508
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Smoothwall Express < 3.1 Update 13 Reflected XSS in redirect.cgi via url Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitation of the url parameter. Attackers can craft malicious URLs with javascript: schemes that execute arbitrary JavaScript in victims' browsers when clicked through the unsanitized link.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Smoothwall Express 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Smoothwall Express是Smoothwall开源的一个基于GNU/Linux的防火墙操作系统。 Smoothwall Express 3.1 Update 13之前版本存在跨站脚本漏洞，该漏洞源于对url参数清理不当，可能导致反射型跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Smoothwall | Express | 0 ~ 3.1 Update 13 | - |
|
II. Public POCs for CVE-2026-27508
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-27508
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Express
-
CVE-2026-26352
Smoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi -
CVE-2024-10491
Preload arbitrary resources by injecting additional `Link` h -
CVE-2024-9266
Open Redirect -
CVE-2024-43796
express vulnerable to XSS via response.redirect() -
CVE-2024-29041
Express.js Open Redirect in malformed URLs
Same vendor: Smoothwall
-
CVE-2026-26352
Smoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi -
CVE-2019-25395
Smoothwall Express 3.1 'preferences.cgi' Cross-Site Scriptin -
CVE-2019-25394
Smoothwall Express 3.1 'modem.cgi' Cross-Site Scripting -
CVE-2019-25393
Smoothwall Express 3.1 'smoothinfo.cgi' Cross-Site Scripting -
CVE-2019-25392
Smoothwall Express 3.1 'iptools.cgi' Cross-Site Scripting
Same weakness: CWE-79
-
CVE-2023-5648
Brocade ASCG v3.0以下版本HTTP头缺失漏洞 -
CVE-2026-94154
Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site -
CVE-2026-95595
WordPress Disable and Remove Google Fonts | GDPR & DSGVO fri -
CVE-2026-94670
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripti -
CVE-2026-94662
WordPress Unlimited Elements For Elementor plugin <= 2.0.19
V. Comments for CVE-2026-27508
No comments yet