CVE-2026-32757 Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
Authenticated attackers can inject HTML and JavaScript into eCard emails by bypassing sanitization, enabling phishing attacks against other members.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-32757?
CVE-2026-32757 is a medium-severity cross-site scripting vulnerability in admidio, published on 19 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] value instead of the HTMLPurifier-sanitized $formValues['ecard_message'] when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent to other members, bypassing the server-side HTMLPurifier sanitization that is properly applied to the ecard_message field during form validation. An attack can result in any member or role receiving phishing content that appears legitimate, crossing from the web application into recipients' email clients. This issue has been fixed in version 5.0.7.
Weakness: CWE-79
Which versions are affected by CVE-2026-32757?
2 open source packages ship an affected version, including admidio/admidio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | All versions | 5.0.7 |
admidio/admidio Packagist | All versions | 5.0.7 |
Products include Admidio Admidio.
How do I fix CVE-2026-32757?
Upgrade admidio/admidio to 5.0.7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-32757 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32757 exists.
Other vulnerabilities in admidio
- CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php
- CVE-2021-32630 Various
- CVE-2026-32817 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
- CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
- CVE-2026-32756 Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
Sources
Also known as GHSA-4wr4-f2qf-x5wj.