Skip to main content

Admidio CVE-2026-82656

| EUVDEUVD-2026-68242 LOW
Path Traversal (CWE-22)
2026-08-30 VulnCheck GHSA-97g5-g4rj-rr3j
Path Traversal Admidio
2.1
CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY
2.1 LOW
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
2.6 LOW

Network delivery but requires album-creation auth (PR:L), victim-side extraction (UI:R), high complexity, and yields only low integrity impact with no confidentiality or availability effect.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

3
CVE Published
Aug 31, 2026 - 10:50 cve.org
LOW 2.1
Patch available
Aug 30, 2026 - 16:01 EUVD
Analysis Generated
Aug 30, 2026 - 15:04 vuln.today

DescriptionCVE.org

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.

AnalysisAI

Zip Slip-style path traversal in Admidio's photo ZIP download feature allows authenticated users who hold album-creation rights to embed directory traversal sequences in album names, which are then reflected verbatim as archive entry paths. When a recipient extracts the resulting ZIP, files may be written outside the intended target directory, providing a limited but real filesystem write primitive on the extracting machine. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an account with album-creation privileges within the Admidio application (PR:L); anonymous or unprivileged users cannot trigger the vulnerable ZIP generation path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 2.1 is consistent with this vulnerability's constrained threat model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Admidio 5.0.12 or later, which resolves the issue by sanitizing album names before use as ZIP archive entry paths; the vendor advisory at https://github.com/Admidio/admidio/security/advisories/GHSA-gm42-rf3m-682v confirms this as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Admidio

View all
CVE-2024-38529 HIGH POC
8.8 Jul 29

Admidio is a free, open source user management system for websites of organizations and groups. Rated high severity (CVS
CVE-2024-37906 HIGH POC
8.8 Jul 29

Admidio is a free, open source user management system for websites of organizations and groups. Rated high severity (CVS
CVE-2021-32630 HIGH POC
8.8 May 20

Admidio is a free, open source user management system for websites of organizations and groups. Rated high severity (CVS
CVE-2023-3302 HIGH POC
7.8 Jun 23

Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9. Rated hig
CVE-2017-6492 HIGH POC
7.2 Mar 05

SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5. Rated high severity (CVSS
CVE-2023-3692 HIGH POC
7.2 Jul 16

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10. Rated high severit
CVE-2022-0991 HIGH POC
7.1 Mar 19

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. Rated high severity (CVSS 7.1), thi
CVE-2018-25370 MEDIUM POC
6.9 May 25

Admidio 3.3.5 contains a cross-site request forgery vulnerability that allows low-privilege users to increase their perm
CVE-2023-4190 MEDIUM POC
6.5 Aug 06

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11. Rated medium severity (CVSS 6.5),

CVE-2023-47380 MEDIUM POC
6.1 Nov 22

Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerabil
CVE-2021-43810 MEDIUM POC
6.1 Dec 07

Admidio is a free open source user management system for websites of organizations and groups. Rated medium severity (CV
CVE-2023-3304 MEDIUM POC
5.4 Jun 23

Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. Rated medium severity (CVSS 5.4), this vuln

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-82656 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy