Executive brief
Admidio is a web-based membership and event management system. The photo album download feature fails to sanitize album names, allowing users with album creation rights to include directory traversal sequences in archive filenames. When recipients extract the downloaded ZIP file, these malicious paths can write files outside the intended directory, potentially overwriting or planting files on the user's system.
Technical details
This is a path traversal vulnerability (CWE-22) in the photo ZIP download functionality (modules/photos/photo_download.php). The vulnerability exists because individual photo filenames are sanitized using basename() before being added to the archive, but the album name—retrieved directly from the database without validation—is used verbatim as the enclosing directory path. An authenticated user with album-creation rights can craft an album name containing directory traversal sequences (e.g., "../../../malicious") that become embedded in ZIP archive entry names. When a recipient extracts the archive with a path-aware extraction tool, these traversal segments escape the intended directory. The fix involves applying basename() or explicit path sanitization to the album name before using it as a path segment in the archive.
Affected products
- Admidio Admidio before 5.0.12
Timeline
- 2026-08-16: disclosed
- 2026-08-30: patched: Fixed in version 5.0.12