Path Traversal Vulnerability in Admidio User Management Solution

CVE-2026-41656

What is CVE-2026-41656?

A vulnerability in the Admidio user management solution allows attackers to exploit the add mode in modules/documents-files.php by injecting unvalidated path traversal characters through a name parameter. This critical oversight, compounded by the absence of adequate CSRF protection and the use of SameSite=Lax session cookies, enables low-privileged attackers to craft malicious links. When an unsuspecting documents administrator clicks on such a link, the attacker can register arbitrary files, potentially exposing sensitive data like database credentials. This vulnerability has been addressed in version 5.0.9.

References