Executive brief
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
Affected products
- Packagist admidio/admidio
Junglewise Threat Intelligence
CVE-2026-41656: Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
CVE-2026-41656 · Severity: low · CVSS 3.1 · Published 2026-04-29
Technologies: admidio/admidio (Packagist). Vendors: Packagist.
Related threats
- Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installati
- Admidio unauthorized inventory field deletion in inventory module
- Admidio sensitive information disclosure in application logs
- Admidio CSRF in PKCS#12 private key export
- Admidio IDOR in documents-files.php move_save handler