CVE-2026-82656 in Admidio
Summary
by MITRE • 08/30/2026
Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/30/2026
The vulnerability identified in Admidio versions prior to 5.0.12 represents a critical input validation failure within the photo management subsystem, specifically affecting the functionality responsible for generating and delivering ZIP archives of user-created albums. This flaw stems from an insufficient sanitization process applied to album names at the point where they are incorporated into archive entry paths. When an authenticated user with permission to create or modify albums provides a name containing directory traversal sequences such as dot-dot-slash, the system fails to neutralize these characters before embedding them in the file structure of the resulting ZIP package. This lack of rigorous input validation allows malicious actors to manipulate the internal pathing logic of the archive format itself rather than just the display text or database entry associated with the album name.
From a technical perspective, this issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as directory traversal. The core mechanism involves the exploitation of how ZIP file formats handle relative paths within their central directory and local file headers. By injecting path traversal segments into the album name field, an attacker effectively alters the destination path for files contained within the archive. When this maliciously crafted archive is downloaded by a victim or processed by another system component that extracts its contents without applying equivalent safeguards, the operating system interprets the relative paths literally. Consequently, instead of placing files in the intended subdirectory designated for album photos, the extraction process writes them to arbitrary locations on the file system hierarchy determined by the number and direction of the traversal sequences used.
The operational impact of this vulnerability is significant because it enables unauthorized file write operations outside the web root or application-specific directories where Admidio typically stores user-generated content. If an attacker can control what files are written, they may overwrite critical configuration files, inject malicious scripts into executable directories, or plant backdoors that persist on the server. This capability transforms a simple data input error into a potential remote code execution vector if combined with other factors such as predictable file naming conventions for uploaded images or accessible web directories. Even without immediate code execution, the ability to write arbitrary files can lead to information disclosure by overwriting sensitive logs or configuration settings that might expose internal system details or credentials stored in plaintext within certain Admidio components.
This vulnerability aligns with several tactics and techniques defined in the MITRE ATT&CK framework. It primarily relates to Initial Access through Valid Accounts, as it requires authentication, but more specifically maps to Defense Evasion via Path Traversal for hiding malicious files or bypassing file system restrictions. In terms of persistence and impact, it falls under Command and Control if used to establish a foothold, or Impact if utilized to corrupt data integrity by overwriting essential application files. The attack vector is typically remote but requires prior authentication, which limits the blast radius compared to unauthenticated vulnerabilities but increases the severity due to the higher privilege level of authenticated users who can create albums.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to upgrade Admidio to version 5.0.12 or later, where this input validation flaw has been addressed by developers implementing strict allow-listing for album name characters and robust path canonicalization before archive generation. For environments unable to patch immediately, administrators should enforce strict file naming policies that reject any non-alphanumeric characters in user inputs via server-side application logic if not already handled at the framework level. Additionally, web servers hosting Admidio should be configured with chroot jails or restricted permissions for the directory where album archives are temporarily stored during processing, ensuring that even if traversal occurs, writes are confined to a sandboxed environment. Regular security audits of file upload and archive generation modules are recommended to detect similar patterns in other parts of the application codebase.