CVE-2026-41656 Details
Description
Admidio is an open-source user management solution. Prior to version 5.0.9, the add mode in modules/documents-files.php accepts a name parameter validated only as 'string' type (HTML encoding), allowing path traversal characters (../) to pass through unfiltered. Combined with the absence of CSRF protection on this endpoint and SameSite=Lax session cookies, a low-privileged attacker can trick a documents administrator into clicking a crafted link that registers an arbitrary server file (e.g., install/config.php containing database credentials) into a documents folder accessible to the attacker. This issue has been patched in version 5.0.9.
A path traversal vulnerability has been identified in Admidio versions prior to 5.0.9. The issue arises in the documents module, specifically within the 'add' mode of 'modules/documents-files.php'. The vulnerability allows low-privileged attackers to exploit unvalidated 'name' parameters, bypassing security measures and enabling the registration of arbitrary server files into accessible documents folders. This exploitation is facilitated by the lack of Cross-Site Request Forgery (CSRF) protection on the endpoint and the use of SameSite=Lax session cookies, which together create a window for social engineering attacks.
Users are advised to update to Admidio version 5.0.9, which addresses this vulnerability by implementing proper input validation, adding CSRF protection to the 'add' mode, and incorporating path canonicalization checks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 7, 2026CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Admidio/admidio/security/advisories/GHSA-m9h6-8pqm-xrhf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Admidio/admidio/releases/tag/v5.0.9 | [email protected] | Release NotesVendor |
| https://github.com/Admidio/admidio/security/advisories/GHSA-m9h6-8pqm-xrhf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Admidio | <= 5.0.8 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |