VulnSocial

CVE-2026-41655Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST parameter is a safe filename before passing it to ECard::getEcardTemplate(). An authenticated user can supply a path traversal payload (e.g., ../config.php) to read arbitrary files accessible to the web server process, including adm_my_files/config.php which contains database credentials. This issue has been patched in version 5.0.9.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 4 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-05-07: 4Technical Details · 2026-05-07: 305-07
Signal classification2 categories
Disclosure
375.0%
General
125.0%
Referenced assets4 URLs
Full discourse4 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-41655 Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST parameter is… https://www.cve.org/CVERecord?id=CVE-2026-41655 ----- Traducción: CVE-2026-41655 Adm… http://infoflow.cloud`

    Post summary

    The post briefly cites CVE‑2026‑41655, noting a lack of validation for an ecard_template POST parameter, but offers no proofs, exploit code, patch information, or active exploitation evidence.

    0000031
    75 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-41655 Admidio is an open-source user management solution. Prior to version 5.0.9, the ecard_preview.php endpoint does not validate that the ecard_template POST parameter is… https://www.cve.org/CVERecord?id=CVE-2026-41655

    Post summary

    The text discloses a validation flaw in Admidio's ecard_preview.php endpoint, referencing CVE-2026-41655, but does not provide exploit code, active attack evidence, or patch information.

    00000110
    57.4K followersView on X
  • CVEarity@CVEarity
    Disclosure

    ⚡ New CVE Alert: CVE-2026-41655 📊 Severity: 6.5 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41655 #CVE-2026-41655 #CVE #Medium #CyberSecurity #InfoSec https://t.co/xhwb7D1rEX

    Post summary

    The post simply announces CVE-2026-41655 with a severity score of 6.5 and no additional exploitation or patch details.

    0000039
    152 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-41655 Path Traversal in Admidio Prior to Version 5.0.9 Enables Arbitrary File Read https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41655

    Post summary

    The text announces a CVE‑2026‑41655 path‑traversal flaw in Admidio versions before 5.0.9 that allows arbitrary file reading, with a link to further details.

    0000042
    4.0K followersView on X

Explore more

Back to dashboard