CVE-2026-32757: 
PHP vulnerability analysis and mitigation

CVE-2026-32757 is an HTML email injection vulnerability in Admidio's eCard (greeting card) feature, classified as an HTMLPurifier bypass that allows authenticated low-privileged users to inject arbitrary HTML into emails sent to organization members. It affects Admidio versions up to and including 5.0.6 (composer package admidio/admidio), and was disclosed on March 15, 2026, with the patch released the same day in version 5.0.7. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Admidio Advisory).

The root cause (CWE-79, CWE-20) lies in modules/photos/ecard_send.php, where the raw $_POST['ecard_message'] value is captured at line 38 before form validation runs. Although HTMLPurifier sanitization is correctly applied at line 61 via $photosEcardSendForm->validate($_POST), the sanitized result stored in $formValues['ecard_message'] is never used — instead, the raw $postMessage is passed to parseEcardTemplate() at lines 159 and 201. Within ECard.php (line 144), the message is inserted directly into the HTML template via $pregRepArray['/<% ecard_message%>/'] = $ecardMessage without any encoding, unlike recipient fields which are properly encoded with SecurityUtils::encodeHTML(). Notably, the eCard preview correctly uses the sanitized value, creating a deceptive discrepancy where the preview appears safe but the actual sent email contains unsanitized content (GitHub Advisory, Admidio Advisory).

An authenticated attacker with low privileges can inject arbitrary HTML — including fake login forms, deceptive hyperlinks, and tracking pixels — into greeting card emails delivered to any organization member or role. Because the emails use legitimate Admidio branding and templates, recipients are likely to trust the content, enabling effective phishing campaigns that can harvest credentials or redirect users to attacker-controlled sites. The vulnerability crosses a security boundary (scope change), as the attack originates within the Admidio web application but impacts email recipients outside of it; availability is not affected, but both confidentiality and integrity are at low risk (GitHub Advisory).

A proof-of-concept exploit is publicly available in the Admidio security advisory, consisting of concrete curl commands with crafted ecard_message payloads that can be executed against any vulnerable Admidio instance by an authenticated user with access to the photo/eCard module. The EPSS score is approximately 0.029% (4th percentile), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Admidio Advisory).

1. Reconnaissance: Identify a target Admidio instance running version 5.0.6 or earlier with the photo module and eCard feature enabled. Obtain a valid low-privileged user account.
2. Authenticate and obtain session tokens: Log in to the Admidio instance to retrieve a valid ADMIDIO_SESSION_ID cookie and a CSRF token (adm_csrf_token).
3. Identify target recipient: Enumerate organization members or roles to find the target recipient's UUID (target_user_uuid).
4. Craft malicious eCard payload: Prepare an HTML payload for the ecard_message parameter, such as a fake login form or a tracking pixel:

   ecard_message=<h2>Important Security Update</h2><p>Your account has been compromised. <a href="https://evil.example.com/phish">Verify your identity here</a>.</p><img src="https://evil.example.com/track.gif" width=1 height=1>

5. Send the malicious eCard via POST request:

   curl -X POST "https://TARGET/adm_program/modules/photos/ecard_send.php" \
     -H "Cookie: ADMIDIO_SESSION_ID=<session_id>" \
     -d "adm_csrf_token=<csrf_token>" \
     -d "ecard_template=<template_id>" \
     -d "photo_uuid=<photo_uuid>" \
     -d "photo_nr=1" \
     -d "ecard_message=<malicious_html>" \
     -d "ecard_recipients[]=<target_user_uuid>"

6. HTMLPurifier bypass occurs: The server runs sanitization but discards the result, embedding the raw malicious HTML into the email template and sending it to the recipient.
7. Recipient interaction: The target receives a legitimate-looking Admidio greeting card email containing the injected HTML; clicking links or loading images triggers the attacker's objective (credential harvesting, tracking, or redirection) (Admidio Advisory).

• Network: Outbound HTTP requests from email clients to unexpected external domains (e.g., evil.example.com) originating from links or images in Admidio greeting card emails; tracking pixel loads from external IPs in email server logs.
• Logs: Admidio web server access logs showing POST requests to /adm_program/modules/photos/ecard_send.php with unusually large or HTML-rich ecard_message parameters; repeated eCard sends from a single low-privileged user account to multiple recipients in a short timeframe.
• Email Server: Outbound emails from the Admidio system containing HTML bodies with external links, <form> tags, <script> tags, or <img> tags pointing to non-organizational domains embedded in greeting card messages.
• Database: Entries in the Admidio messages table (adm_messages_content) containing raw HTML with external URLs, <script> blocks, or form elements in eCard message content (Admidio Advisory).

Upgrade Admidio to version 5.0.7 or later, which addresses this vulnerability along with several other security issues (Admidio Release). The fix requires changing ecard_send.php to use $formValues['ecard_message'] (the HTMLPurifier-sanitized value) instead of the raw $_POST['ecard_message'] after form validation runs. As additional defense-in-depth, apply SecurityUtils::encodeHTML() to the message placeholder in ECard::parseEcardTemplate(). If immediate upgrade is not possible, consider disabling the eCard/photo module or restricting access to trusted roles only, and implement email authentication controls (SPF, DKIM, DMARC) to reduce phishing effectiveness (GitHub Advisory).

The vulnerability was reported through Bugcrowd and disclosed by the Admidio maintainer (Fasse) on March 15, 2026, with a same-day patch release. The Admidio project strongly recommended updating to version 5.0.7, noting that the release addressed multiple security vulnerabilities, some critical (Admidio Release). No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory.