Path Traversal Vulnerability in Admidio User Management Solution

CVE-2026-41655

What is CVE-2026-41655?

Admidio, an open-source user management solution, has a path traversal vulnerability due to improper validation of the ecard_template POST parameter before it is used in file access functions. This flaw allows authenticated users to exploit the ecard_preview.php endpoint by crafting malicious requests that include path traversal payloads (e.g., ../config.php). If successfully exploited, an attacker can read arbitrary files on the server, including sensitive configuration files that may contain database credentials. This vulnerability has been addressed in version 5.0.9, which is essential for users to update to in order to ensure the security of their installations.

References