CVE-2026-41655
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedAdmidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST parameter is a safe filename before passing it to ECard::getEcardTemplate(). An authenticated user can supply a path traversal payload (e.g., ../config.php) to read arbitrary files accessible to the web server process, including adm_my_files/config.php which contains database credentials. This issue has been patched in version 5.0.9.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceAdmidio versions prior to 5.0.9 contain a path traversal vulnerability in ecard_preview.php where the ecard_template POST parameter is not validated before being passed to ECard::getEcardTemplate(). An authenticated attacker can use traversal sequences (e.g., ../config.php) to read arbitrary files accessible to the web server process, including configuration files containing database credentials.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Admidio installation and versionSearch for Admidio files on the web server, typically in web-accessible directories. Check for a version.php or similar version file within the Admidio installation. Common paths include /admidio/, /var/www/html/admidio/, or within the web root. Look for a VERSION file or examine the admidio.php config file which often contains the version number.Affected if The installed Admidio version is found to be lower than 5.0.9 (e.g., 5.0.8, 5.0.7, 4.x versions)
-
Verify ecard_preview.php existsLocate the ecard_preview.php file within the Admidio installation directory. This file is typically found in the admido root or in a folder related to e-cards functionality. Use file system search commands (find, ls, or similar) to confirm its presence.Affected if The file ecard_preview.php exists in the Admidio installation, indicating the vulnerable component is present
-
Check if ECard functionality is enabledReview the Admidio configuration to determine whether the ECard feature is activated. This may involve checking configuration files (such as config.php or settings within the database) for flags like 'ECARD_ENABLED' or similar. Also verify that the ECard class (ECard::getEcardTemplate) is present in the installation.Affected if The ECard/electronic card feature is enabled or the ECard class exists in the installation, making the path traversal accessible
-
Confirm web server user permissionsCheck the file permissions on sensitive files such as config.php, configuration directories, and any files containing database credentials. Use 'ls -la' or similar commands to inspect permissions. Path traversal exploits rely on the web server process having read access to these files.Affected if The web server process user (www-data, apache, nginx, etc.) has read permissions on sensitive configuration files that could be exposed via traversal sequences like ../config.php
-
Review authentication status for ECard featureDetermine if the ecard_preview.php endpoint is accessible without authentication or requires authenticated access. Test by attempting to access the page or by examining the PHP code in ecard_preview.php for authentication checks. The CVE states an authenticated attacker is required, so verify whether guest/public access is possible.Affected if The ECard preview functionality is accessible to authenticated users, meaning any compromised or malicious authenticated account could exploit this vulnerability
The environment is affected if Admidio version is below 5.0.9 AND the ecard_preview.php file exists AND the ECard feature is available, regardless of whether an attacker already has authenticated access.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to Admidio version 5.0.9 or later. As a compensating control, restrict web server process permissions and ensure database credentials are not stored in files readable by the web server process.
5.0.9
- Backup the current Admidio installation and database before proceeding with the upgrade
- Download Admidio version 5.0.9 from the official source (github.com/Admidio/admidio)
- Extract the downloaded archive
- Replace the existing Admidio files with the files from version 5.0.9, or follow the official update documentation for your installation method
- Verify that the ecard_preview.php file has been updated and now properly validates the ecard_template parameter
- Test that the application functions correctly after the upgrade
- Verify the path traversal vulnerability is mitigated by attempting a test request (with appropriate authorization)
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,088.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-41655 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-41655 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data