6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41655

CVE-2026-41655: Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials

Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST parameter is a safe filename before passing it to ECard::getEcardTemplate(). An authenticated user can supply a path traversal payload (e.g., ../config.php) to read arbitrary files accessible to the web server process, including adm_my_files/config.php which contains database credentials. This issue has been patched in version 5.0.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41655

CVE-2026-41655:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.8	5.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal in the 'ecard_preview.php' script. The root cause is the lack of input validation for 'select' form fields within the Admidio\UI\Presenter\FormPresenter::validate function. An authenticated attacker could submit a path traversal payload (e.g., ../config.php) as the value for the ecard_template parameter. The validate function would incorrectly approve this malicious input. Subsequently, the ecard_preview.php script would pass this payload to the Admidio\Photos\ValueObject\ECard::getEcardTemplate function. This function then concatenates the malicious payload with a base directory and uses it in an fopen call, allowing the attacker to read arbitrary files from the server, including sensitive configuration files containing database credentials. The patch, found in commit 8d00eedfeb8bb2149a8ecc023941664b307c4a01, addresses the vulnerability by adding the missing validation logic to the FormPresenter::validate function, ensuring that only predefined, safe values are accepted for select fields.

Vulnerable functions

Admidio\UI\Presenter\FormPresenter::validate

src/UI/Presenter/FormPresenter.php

This function was missing validation for 'select' type fields. The patch adds a check to ensure that the submitted value for a select box is one of the predefined, allowed options. Before the patch, it would allow any string, including a path traversal payload, to be considered valid.

Admidio\Photos\ValueObject\ECard::getEcardTemplate

src/Photos/ValueObject/ECard.php

This function takes a filename as an argument and uses it directly in a call to `fopen()`. It trusts that the input has been validated, but due to the flaw in `FormPresenter::validate`, it received the raw, unvalidated path traversal payload from the user, leading to arbitrary file reads.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.