HikaShop (com_hikashop) below 6.5.2 - Unauthenticated Open Redirect

HikaShop versions before 6.5.2 carry an open redirect in the currency switcher (CVE-2026-61901). A crafted link using a doubly encoded return address sends the visitor off to an external website once the currency is changed, and no login is needed to use it. The vendor rates it medium severity. The value of it to an attacker is that the link starts on your domain, so it lends your reputation to whatever phishing or malware page it lands on, and it will pass any filter that trusts your site. HikaShop 6.5.2, released 20 July 2026, now decodes and validates the return address before redirecting so only addresses on your own site are accepted. Update to 6.5.2 or later. There is no setting you can change to close this off, so patching is the only fix. Also covered by this rule: CVE-2023-38044 (SQL injection, 4.0.0-4.7.2), CVE-2024-40746 (stored XSS via product description, below 5.1.1), CVE-2025-22210 (authenticated SQL injection in backend category management, 3.3.0-5.1.4) and CVE-2025-25225 (administrator to Super Admin privilege escalation, 1.0.0-5.1.3). Also within this rule: CVE-2023-54364 (HikaShop 4.7.4 reflected XSS) and CVE-2015-7344 (HikaShop below 2.6.0 XSS via an injected payload[/caption]). Both sit below this ceiling and need no separate row.

Affected versions: < 6.5.2

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions