5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32757

CVE-2026-32757: Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] value instead of the HTMLPurifier-sanitized $formValues['ecard_message'] when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent to other members, bypassing the server-side HTMLPurifier sanitization that is properly applied to the ecard_message field during form validation. An attack can result in any member or role receiving phishing content that appears legitimate, crossing from the web application into recipients' email clients. This issue has been fixed in version 5.0.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32757

CVE-2026-32757:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.6	5.0.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic HTML injection flaw caused by a failure to use sanitized data. The root cause is located in the modules/photos/ecard_send.php script. This script correctly invokes the form validation and sanitization process (using HTMLPurifier), but then discards the sanitized ecard_message and instead uses the raw value directly from the $_POST superglobal.

This unsanitized input is then passed to the ECard::parseEcardTemplate method. This method performs a simple string replacement to place the message into the eCard's HTML template, without applying any form of output encoding. This allows an authenticated attacker to inject arbitrary HTML, including phishing links or JavaScript payloads, into emails sent to other users.

The patch, found in commit 931c0a77ccf0f9130273e7eb76a2d5e4506bc2a1, resolves the vulnerability by removing the line that captures the raw POST data and instead correctly using the sanitized $formValues['ecard_message'] when calling parseEcardTemplate. This ensures that only safe, validated HTML is included in the eCard.

Vulnerable functions

ecard_send.php

modules/photos/ecard_send.php

This script is the entry point for the vulnerability. It directly captures the raw 'ecard_message' from the $_POST request into the `$postMessage` variable. This variable, containing unsanitized user input, is then passed to the `parseEcardTemplate` function. The vulnerability was that the result of the form validation and sanitization, stored in `$formValues`, was ignored for the ecard message.

ECard::parseEcardTemplate

src/Photos/ValueObject/ECard.php

This function is responsible for building the HTML for the eCard. It takes the eCard message as an argument and injects it into a template using string replacement without performing any HTML encoding or sanitization. In the vulnerable version, it received raw, user-controlled input from `ecard_send.php`, which allowed for the injection of arbitrary HTML and script content into the generated email.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.