CVE-2026-41655

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST parameter is a safe filename before passing it to ECard::getEcardTemplate(). An authenticated user can supply a path traversal payload (e.g., ../config.php) to read arbitrary files accessible to the web server process, including adm_my_files/config.php which contains database credentials. This issue has been patched in version 5.0.9.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-416564.5Admidio is an open-source user management solution. Prior to version 5.0.9, the add mode in modules/documents-files.php accepts a name paramCVE-2026-416574.9Admidio is an open-source user management solution. Prior to version 5.0.9, the contacts_data.php endpoint uses a weaker permission check (iCVE-2026-416586.5Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructCVE-2026-416592.7Admidio is an open-source user management solution. Prior to version 5.0.9, the member assignment DataTables endpoint (members_assignment_daCVE-2026-41663.5A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub_404F68 of the file /cgi-bin/login.cgi. The CVE-2026-416607.1Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverCVE-2026-416616.1Admidio is an open-source user management solution. Prior to version 5.0.9, an unauthenticated attacker can execute arbitrary JavaScript in CVE-2026-416625.2Admidio is an open-source user management solution. Prior to version 5.0.9, Role::stopMembership() does not verify whether removing a user fCVE-2026-416633.5Admidio is an open-source user management solution. Prior to version 5.0.9, several administrative operations in Admidio's preferences modulCVE-2026-416646.6Integer overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid memory operations with large tensor shapesCVE-2026-416656.1Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for largCVE-2026-416666.6Integer overflow in tensor copy size calculation in Samsung Open Source ONE could lead to out of bounds access during loop state propagation
CVE-2026-41655: Medium severity, CVSS 6.5 | Vulnix