4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41656

CVE-2026-41656: Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read

Admidio is an open-source user management solution. Prior to version 5.0.9, the add mode in modules/documents-files.php accepts a name parameter validated only as 'string' type (HTML encoding), allowing path traversal characters (../) to pass through unfiltered. Combined with the absence of CSRF protection on this endpoint and SameSite=Lax session cookies, a low-privileged attacker can trick a documents administrator into clicking a crafted link that registers an arbitrary server file (e.g., install/config.php containing database credentials) into a documents folder accessible to the attacker. This issue has been patched in version 5.0.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41656

CVE-2026-41656:

4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.8	5.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal in Admidio's document upload functionality, identified as GHSA-m9h6-8pqm-xrhf. The analysis of the patch commit 4a7239a43b18546ab02d10b2fd70fadbb57cf357 confirms the details in the advisory. The exploit chain begins in modules/documents-files.php, where the name parameter is improperly validated, allowing path traversal characters. This tainted input is passed to the Folder.addFolderOrFileToDatabase method, which constructs and stores a malicious file path in the database without sanitization. Finally, when the file is accessed, File.getFullFilePath reconstructs this malicious path, leading to arbitrary file read. The patch rectifies these flaws by enforcing stricter 'file' validation, adding CSRF protection, and implementing a path canonicalization check using realpath() as a defense-in-depth measure.

Vulnerable functions

Folder.addFolderOrFileToDatabase

src/Documents/Entity/Folder.php

This method is vulnerable because it constructs a file path by concatenating a base directory with the user-provided `$newFolderFileName` parameter without proper validation. This allows path traversal characters (`../`) in the filename, enabling an attacker to craft a path to a sensitive file outside of the intended documents directory. The crafted path is then stored in the database.

documents-files.php

modules/documents-files.php

This script is the entry point for the vulnerability. Within the `case 'add':` block, it uses `admFuncVariableIsValid` with the incorrect type `'string'` for the `name` parameter from the user's GET request. This validation fails to sanitize path traversal characters. Additionally, it lacked CSRF protection, allowing an attacker to trick an administrator into executing the vulnerable action.

File.getFullFilePath

src/Documents/Entity/File.php

This function is part of the exploit chain. It retrieves the malicious filename, which includes the path traversal payload, from the database (where it was saved by `addFolderOrFileToDatabase`). It then concatenates this payload with the folder path, reconstructing the full, malicious path to an arbitrary server file, which is then read and served to the attacker.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.