The Event Gallery extension for Joomla, supplied by svenbluege.de, contains a flaw that allows attackers to craft a share link that embeds an unescaped article URL into the share mini page. When the link type “Image Page with Redirect” is enabled, the unvalidated URL is immediately followed by a redirect, which can cause the visitor’s browser to load arbitrary content or a malicious script. The vulnerability would not alter data on the server but would execute scripts or redirect in the victim’s session.

Administrators of sites running the Event Gallery extension for Joomla from svenbluege.de should verify the version. All releases before 6.6.0 are affected. The vulnerability is confined to the front‑end share mini page, so any user who opens a crafted link is at risk.

The base CVSS score of 5.3 indicates moderate severity, but the vulnerability is reachable from a remote web page and can be triggered by any user interacting with a crafted link. Because the flaw does not read or modify server‑side data, the impact is limited to the client. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the low effort required to generate a malicious share link and the wide reach of Joomla sites make the practical exploitation risk significant.