CVE-2026-41656 Overview
CVE-2026-41656 is a path traversal vulnerability [CWE-22] affecting Admidio, an open-source user management solution. The flaw exists in the add mode of modules/documents-files.php, where the name parameter is validated only as a string with HTML encoding. This validation lets path traversal sequences such as ../ pass through unfiltered. The endpoint also lacks Cross-Site Request Forgery (CSRF) protection and relies on SameSite=Lax session cookies. A low-privileged attacker can craft a link that, when clicked by a documents administrator, registers an arbitrary server file into a documents folder accessible to the attacker. Admidio version 5.0.9 patches the issue.
Critical Impact
An attacker can exfiltrate sensitive server files such as install/config.php containing database credentials by tricking an administrator into clicking a crafted link.
Affected Products
- Admidio versions prior to 5.0.9
- modules/documents-files.php add mode endpoint
- Deployments using default SameSite=Lax session cookies
Discovery Timeline
- 2026-05-07 - CVE-2026-41656 published to NVD
- 2026-05-07 - Last updated in NVD database
Technical Details for CVE-2026-41656
Vulnerability Analysis
The vulnerability resides in the documents and files module of Admidio. The add mode accepts a name parameter intended to designate a file to register inside a documents folder. The application validates this parameter only with HTML encoding, treating it as a generic string. It does not strip or reject directory traversal sequences such as ../. As a result, the parameter can reference files outside the intended documents directory.
The endpoint also lacks anti-CSRF tokens. Combined with SameSite=Lax session cookies, an attacker can issue a top-level navigation request that carries the victim administrator's session. When a documents administrator clicks an attacker-crafted link, the application registers the targeted server file into a documents folder controlled by the attacker. The attacker then downloads the file through normal Admidio document workflows.
Root Cause
The root cause is insufficient input validation on the name parameter combined with the absence of CSRF protection on a state-changing endpoint. The application trusts the parameter as a filename without canonicalization or allowlist enforcement. See the GitHub Security Advisory GHSA-m9h6-8pqm-xrhf for advisory details.
Attack Vector
Exploitation requires user interaction from an account with documents administration privileges. The attacker hosts a page or sends a message containing a crafted link to the vulnerable endpoint. When the administrator follows the link while authenticated, the request executes under the administrator's session and registers an arbitrary file path such as ../../install/config.php as a document. The low-privileged attacker then accesses the registered file through the documents listing.
No verified exploit code is currently public. Refer to the advisory for proof-of-concept details when published.
Detection Methods for CVE-2026-41656
Indicators of Compromise
- Web server access logs containing requests to modules/documents-files.php with mode=add and name values containing ../ or URL-encoded %2e%2e%2f sequences.
- New entries in Admidio documents tables referencing files outside the configured documents root, such as install/config.php or other application files.
- Document download events targeting newly added files immediately after an administrator click-through from an external referrer.
Detection Strategies
- Inspect HTTP request bodies and query strings for traversal patterns reaching documents-files.php.
- Correlate administrator browsing sessions with document-add events that originate from cross-origin referrers.
- Audit the Admidio documents folder for entries whose stored path resolves outside the expected directory tree.
Monitoring Recommendations
- Enable verbose web server logging on the Admidio application path and forward logs to a central analytics platform for traversal pattern matching.
- Alert on document-add operations performed within seconds of an external HTTP referrer reaching the application.
- Monitor file access to sensitive paths such as install/config.php and any read after document registration events.
How to Mitigate CVE-2026-41656
Immediate Actions Required
- Upgrade Admidio to version 5.0.9 or later, which patches the parameter validation and adds CSRF protection on the affected endpoint.
- Rotate database credentials and any other secrets stored in install/config.php if exposure is suspected.
- Review the documents folder for unexpected entries and remove files that resolve outside the intended directory.
Patch Information
The issue is fixed in Admidio 5.0.9. Download the release from the Admidio v5.0.9 GitHub release page. Apply the upgrade following the project's standard upgrade procedure and verify the documents module after deployment.
Workarounds
- Restrict access to the Admidio administration interface to trusted networks or VPN until the upgrade is applied.
- Instruct documents administrators to log out of Admidio before browsing untrusted links and to use a dedicated browser profile for administrative tasks.
- Configure session cookies with SameSite=Strict where deployment supports it to limit cross-site request delivery.
- Place the Admidio installation behind a Web Application Firewall rule that blocks ../ and encoded traversal sequences in request parameters.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
