PT-2026-37140 · Admidio · Admidio

Offset · Published 2026-04-29 · Updated 2026-05-07 · CVE-2026-41656

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.9

Description An issue exists in the 'add' mode of the 'modules/documents-files.php' endpoint where the name parameter is validated only as a string, allowing path traversal characters such as ../ to pass unfiltered. Due to the absence of CSRF protection on this endpoint and the use of SameSite=Lax session cookies, a low-privileged attacker can trick a documents administrator into clicking a crafted link. This action registers an arbitrary server file, such as 'install/config.php' which may contain database credentials, into a documents folder accessible to the attacker, leading to arbitrary server file read.

Recommendations Update to version 5.0.9. As a temporary workaround, restrict access to the 'modules/documents-files.php' endpoint or avoid using the name parameter in the 'add' mode until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41656

GHSA-M9H6-8PQM-XRHF

Affected Products

Admidio

References · 8

• 🔥 https://github.com/Admidio/admidio/security/advisories/GHSA-m9h6-8pqm-xrhf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41656 · Security Note
• https://osv.dev/vulnerability/GHSA-m9h6-8pqm-xrhf · Vendor Advisory
• https://github.com/Admidio/admidio · Note
• https://github.com/Admidio/admidio/releases/tag/v5.0.9 · Note
• https://twitter.com/CVEnew/status/2052400852816855096 · Twitter Post
• https://twitter.com/infoflowcloud/status/2052402036847550917 · Twitter Post
• https://twitter.com/CVEarity/status/2052387631632351266 · Twitter Post