CVE-2026-41655: Admidio Path Traversal Vulnerability

CVE-2026-41655 Overview

CVE-2026-41655 is a path traversal vulnerability [CWE-22] in Admidio, an open-source user management solution. The flaw exists in the ecard_preview.php endpoint, which fails to validate the ecard_template POST parameter before passing it to ECard::getEcardTemplate(). An authenticated attacker can supply traversal sequences such as ../config.php to read arbitrary files accessible to the web server process. The most sensitive target is adm_my_files/config.php, which contains database credentials. The maintainers patched the issue in version 5.0.9.

Critical Impact
Authenticated attackers can read arbitrary files readable by the web server, including database credentials stored in adm_my_files/config.php.

Affected Products

Admidio versions prior to 5.0.9
The ecard_preview.php endpoint
The ECard::getEcardTemplate() template loader

Discovery Timeline

2026-05-07 - CVE CVE-2026-41655 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-41655

Vulnerability Analysis

The vulnerability resides in ecard_preview.php, which accepts an ecard_template POST parameter and forwards it directly to ECard::getEcardTemplate(). The endpoint does not enforce that the value is a safe filename within the expected template directory. As a result, the parameter is concatenated into a filesystem path and read by the web server. An authenticated user can submit traversal payloads such as ../config.php to break out of the templates directory. The function returns the file contents in the preview response, exposing them to the attacker. Because adm_my_files/config.php stores database credentials in plaintext PHP, exfiltration of that file leads to full database compromise.

Root Cause

The root cause is missing input validation on a user-controlled filename. The application trusts the ecard_template parameter and constructs a path without canonicalization, basename extraction, or an allowlist of permitted templates. This is a textbook instance of CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Attack Vector

The attack requires network access to the Admidio web application and a valid authenticated session. An attacker submits a POST request to ecard_preview.php with ecard_template set to a traversal sequence pointing at the desired file. The server reads and returns the file contents. Files outside the web root remain inaccessible only if filesystem permissions exclude the web server user, so any file readable by PHP is in scope.

No verified exploit code is published. See the GitHub Security Advisory GHSA-m3vp-3jjm-gpmx for technical details.

Detection Methods for CVE-2026-41655

Indicators of Compromise

POST requests to ecard_preview.php containing ../ or URL-encoded %2e%2e%2f sequences in the ecard_template parameter
Access log entries referencing ecard_template= values that do not match legitimate template filenames in the Admidio templates directory
Unexpected reads of adm_my_files/config.php by the web server process

Detection Strategies

Inspect web server and application logs for POST bodies to ecard_preview.php and flag any ecard_template value containing path separators or traversal tokens
Deploy a web application firewall rule that blocks traversal patterns in the ecard_template parameter
Correlate authenticated session activity with anomalous template parameter values to identify abuse from compromised low-privilege accounts

Monitoring Recommendations

Enable file integrity monitoring on adm_my_files/config.php and other sensitive PHP configuration files
Alert on outbound database authentication attempts from hosts that should not initiate them, which can indicate stolen credentials
Track Admidio version inventory across deployments to confirm all instances run 5.0.9 or later

How to Mitigate CVE-2026-41655

Immediate Actions Required

Upgrade Admidio to version 5.0.9 or later, available at the Admidio Release v5.0.9 page
Rotate database credentials stored in adm_my_files/config.php if the application was exposed to untrusted authenticated users prior to patching
Audit Admidio access logs for prior exploitation attempts targeting ecard_preview.php

Patch Information

The maintainers fixed the issue in Admidio 5.0.9 by validating the ecard_template parameter before it reaches ECard::getEcardTemplate(). Refer to the GitHub Security Advisory GHSA-m3vp-3jjm-gpmx for the full advisory and to the Admidio Release v5.0.9 notes for upgrade guidance.

Workarounds

Restrict access to ecard_preview.php at the reverse proxy or web server until the upgrade is applied
Apply WAF rules that reject ecard_template values containing ../, ..\, or encoded equivalents
Tighten filesystem permissions so the PHP process cannot read configuration files it does not need at runtime

bash

# Example nginx rule to block traversal in ecard_template parameter
if ($request_method = POST) {
    if ($request_body ~* "ecard_template=[^&]*(\.\./|%2e%2e%2f|\.\.\\)") {
        return 403;
    }
}