CVE-2026-41655: 
PHP vulnerability analysis and mitigation

CVE-2026-41655 is a path traversal vulnerability in Admidio, an open-source user management solution, affecting all versions up to and including 5.0.8. The flaw exists in the ecard_preview.php endpoint, which fails to validate the ecard_template POST parameter before passing it to ECard::getEcardTemplate(), allowing authenticated users to read arbitrary files on the server — including adm_my_files/config.php, which contains database credentials. The advisory was published on April 23, 2026, and the CVE was published to the National Vulnerability Database on May 7, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Github Advisory).

The root cause (CWE-22: Path Traversal) is an inconsistency between ecard_preview.php and ecard_send.php: the preview endpoint relies solely on strStripTags() for input sanitization, which does not strip path traversal sequences, while the send endpoint correctly uses admFuncVariableIsValid() with the 'file' type, which calls strIsValidFileName() and rejects any value where basename($filename) !== $filename. The unvalidated ecard_template value is concatenated directly into a file path in ECard::getEcardTemplate() (src/Photos/ValueObject/ECard.php:67-77), so a payload of ../config.php resolves to ADMIDIO_PATH/adm_my_files/config.php. Exploitation requires only a valid authenticated session and a CSRF token extracted from the ecard form, with no administrative privileges needed (GitHub Advisory).

Successful exploitation exposes database credentials ($g_adm_srv, $g_adm_db, $g_adm_usr, $g_adm_pw) stored in adm_my_files/config.php, which — if the database is network-accessible — could enable full database compromise. Beyond credentials, attackers can read arbitrary PHP source files to uncover application logic and internal secrets, and with deeper traversal (e.g., ../../../../../etc/passwd) can access OS-level system files. There is no integrity or availability impact, but the confidentiality breach has a high severity given the sensitivity of the exposed data and the low privilege bar required (GitHub Advisory).

A public proof-of-concept curl command is included in the official GitHub Security Advisory, making exploitation straightforward for any authenticated user. The EPSS score is approximately 0.052% (17th percentile), indicating a currently low but non-negligible probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation, threat actor attribution, or inclusion in the CISA KEV catalog at this time (Github Advisory).

1. Authenticate: Log in to the target Admidio instance with any valid member account — no administrative privileges are required.
2. Initialize session form object: Navigate to /modules/photos/ecards.php?photo_uuid=<valid_album_uuid>&photo_nr=1 to load the ecard form and create a session-bound form object.
3. Extract CSRF token: Inspect the rendered HTML of the ecard form to retrieve the adm_csrf_token value.
4. Send path traversal payload: Issue a POST request to ecard_preview.php with the traversal payload as the ecard_template parameter:

curl -b 'PHPSESSID=<session_cookie>' \
  -X POST 'https://target/modules/photos/ecard_preview.php' \
  -d 'adm_csrf_token=<csrf_token>&ecard_template=../config.php&ecard_message=test&photo_uuid=<valid_uuid>&photo_nr=1&submit_action=preview'

5. Extract credentials: The response body will contain the contents of adm_my_files/config.php rendered inside the ecard preview HTML, including $g_adm_srv, $g_adm_db, $g_adm_usr, and $g_adm_pw.
6. Escalate (optional): Use deeper traversal payloads (e.g., ../../system/bootstrap/constants.php or ../../../../../etc/passwd) to read additional PHP source files or OS system files for further reconnaissance (GitHub Advisory).

• Network: Unexpected POST requests to /modules/photos/ecard_preview.php containing ecard_template values with ../ sequences or absolute path components; outbound database connections from the web server to unusual hosts following such requests.
• Logs: Web server access logs showing POST requests to ecard_preview.php with URL-encoded or raw path traversal strings (e.g., %2e%2e%2f, ../) in the POST body; repeated requests from the same session targeting different traversal depths.
• File System: No file system artifacts are created by this read-only attack, but review of adm_my_files/config.php access timestamps may reveal unauthorized reads if filesystem auditing is enabled.
• Application Logs: Admidio application logs showing form validation activity for the ecard preview endpoint from non-administrative accounts at unusual times (GitHub Advisory).

Admidio has patched this vulnerability in version 5.0.9, released April 18, 2026; all users on version 5.0.8 or earlier should upgrade immediately. The fix adds admFuncVariableIsValid() with the 'file' type to ecard_preview.php before passing the template name to getEcardTemplate(), matching the validation already present in ecard_send.php. As an alternative systemic fix, adding select box value validation to FormPresenter::validate() to verify submitted values against predefined options would protect all select boxes application-wide. If immediate upgrade is not possible, consider restricting access to the ecard_preview.php endpoint at the web server level for non-administrative users (Admidio Release, GitHub Advisory).