CVE-2026-82656
Last modified
CVE-2026-82656 is a low-severity vulnerability rated 2.6/10 on the CVSS scale. Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.
Metrics
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Admidio | admidio | < 5.0.12 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-82656?
How severe is CVE-2026-82656?
How do I fix CVE-2026-82656?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-82650SiYuan 3.8.0 contains a path traversal / sensitive file expo…4.4
- CVE-2026-82651SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath g…4.9
- CVE-2026-82652SiYuan before v3.8.1 fails to filter invisible-tier content …5.3
- CVE-2026-82653SiYuan before v3.8.1 contains a stored cross-site scripting …8.9
- CVE-2026-82654SiYuan before v3.8.1 fails to properly escape block name, al…8.9
- CVE-2026-82655Admidio before 5.0.12 contains a blind SQL injection vulnera…7.5
- CVE-2026-82657Admidio before 5.0.12 fails to enforce login-only module res…7.5
- CVE-2026-82658Admidio versions before 5.0.12 contain a broken access contr…4.3
- CVE-2026-82659nodemailer before 9.0.1 fails to apply disableFileAccess and…7.1
- CVE-2026-8266A vulnerability was detected in Open5GS up to 2.7.7. This af…6.5
- CVE-2026-82660Nodemailer before 8.0.9 fails to enforce disableFileAccess a…5.4
- CVE-2026-82661Nodemailer before 8.0.9 fails to sanitize carriage return an…5.4
Are you affected by CVE-2026-82656?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST