https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 02:25:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-309041 EUVD-2026-309041 https://cve.radiocsirt.org/vuln/euvd-2026-309041 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41655 <p>Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST parameter is a safe filename before passing it to ECard::getEcardTemplate(). An authenticated user can supply a path traversal payload (e.g., ../config.php) to read arbitrary files accessible to the web server process, including adm_my_files/config.php which contains database credentials. This issue has been patched in version 5.0.9.</p> <p>Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST parameter is a safe filename before passing it to ECard::getEcardTemplate(). An authenticated user can supply a path traversal payload (e.g., ../config.php) to read arbitrary files accessible to the web server process, including adm_my_files/config.php which contains database credentials. This issue has been patched in version 5.0.9.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41655 https://cve.radiocsirt.org/vuln/ghsa-m3vp-3jjm-gpmx <p><strong>Affected:</strong> Packagist: admidio/admidio</p> <p>## Summary</p> <p>The `ecard_preview.php` endpoint does not validate that the `ecard_template` POST parameter is a safe filename before passing it to `ECard::getEcardTemplate()`. An authenticated user can supply a path traversal payload (e.g., `../config.php`) to read arbitrary files accessible to the web server process, including `adm_my_files/config.php` which contains database credentials.</p> <p>## Details</p> <p>**Root Cause:** The `ecard_template` parameter is a select box whose value is only sanitized via `strStripTags()` during form validation, which does not restrict path traversal characters. Unlike `ecard_send.php` which explicitly validates the template name as a safe filename, `ecard_preview.php` omits this check entirely.</p> <p>**Code Path:**</p> <p>1. `modules/photos/ecards.php:143-152` — The form creates a select box with template filenames from `adm_my_files/ecard_templates/`. The form object is stored in the session.</p> <p>2. `modules/photos/ecard_preview.php:33-34` — The POST request is validated against the stored form object: ```php $categoryEditForm = $gCurrentSession-&gt;getFormObject($_POST[&#39;adm_csrf_token&#39;]); $formValues = $categoryEditForm-&gt;validate($_POST); ```</p> <p>3. `src/UI/Presenter/FormPresenter.php:2190-2243` — The `validate()` method applies `StringUtils::strStripTags()` to all values and performs type-specific checks for `captcha`, `date`, `editor`, `email`, `number`, `url`, and `uuid` — but has **no validation case for select box values**. The attacker-controlled value `../config…</p> <p><strong>Affected:</strong> Packagist: admidio/admidio</p> <p>## Summary</p> <p>The `ecard_preview.php` endpoint does not validate that the `ecard_template` POST parameter is a safe filename before passing it to `ECard::getEcardTemplate()`. An authenticated user can supply a path traversal payload (e.g., `../config.php`) to read arbitrary files accessible to the web server process, including `adm_my_files/config.php` which contains database credentials.</p> <p>## Details</p> <p>**Root Cause:** The `ecard_template` parameter is a select box whose value is only sanitized via `strStripTags()` during form validation, which does not restrict path traversal characters. Unlike `ecard_send.php` which explicitly validates the template name as a safe filename, `ecard_preview.php` omits this check entirely.</p> <p>**Code Path:**</p> <p>1. `modules/photos/ecards.php:143-152` — The form creates a select box with template filenames from `adm_my_files/ecard_templates/`. The form object is stored in the session.</p> <p>2. `modules/photos/ecard_preview.php:33-34` — The POST request is validated against the stored form object: ```php $categoryEditForm = $gCurrentSession-&gt;getFormObject($_POST[&#39;adm_csrf_token&#39;]); $formValues = $categoryEditForm-&gt;validate($_POST); ```</p> <p>3. `src/UI/Presenter/FormPresenter.php:2190-2243` — The `validate()` method applies `StringUtils::strStripTags()` to all values and performs type-specific checks for `captcha`, `date`, `editor`, `email`, `number`, `url`, and `uuid` — but has **no validation case for select box values**. The attacker-controlled value `../config…</p> https://cve.radiocsirt.org/vuln/ghsa-m3vp-3jjm-gpmx