HTML Injection Vulnerability in Admidio User Management Solution

CVE-2026-32757

What is CVE-2026-32757?

Admidio, an open-source user management solution, has a vulnerability in versions 5.0.6 and earlier where the eCard send handler fails to sanitize user input adequately. Specifically, the raw $_POST['ecard_message'] is used to construct greeting card HTML instead of the sanitized version, allowing authenticated attackers to inject malicious HTML and JavaScript. This can lead to phishing attacks, as the compromised emails can be delivered to other members, appearing legitimate and bypassing the server-side HTMLPurifier validation. The issue has been addressed in version 5.0.7.

References