CVE-2026-41655 Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials
Authenticated attackers can exploit path traversal in the ecard preview feature to read arbitrary server files, including database credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41655?
CVE-2026-41655 is a medium-severity path traversal vulnerability in admidio, published on 7 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST parameter is a safe filename before passing it to ECard::getEcardTemplate(). An authenticated user can supply a path traversal payload (e.g., ../config.php) to read arbitrary files accessible to the web server process, including adm_my_files/config.php which contains database credentials. This issue has been patched in version 5.0.9.
Weakness: CWE-22
Which versions are affected by CVE-2026-41655?
2 open source packages ship an affected version, including admidio/admidio.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | All versions | 5.0.9 |
admidio/admidio Packagist | All versions | 5.0.9 |
How do I fix CVE-2026-41655?
Upgrade admidio/admidio to 5.0.9 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-41655 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41655 exists.
Sources
Also known as GHSA-m3vp-3jjm-gpmx.