CVE-2026-82656

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82656

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82656.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82656

Aliases

GHSA-gm42-rf3m-682v

Published

2026-08-30T14:33:36.502Z

Modified

2026-09-02T03:30:23.530497916Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Admidio before 5.0.12 Path Traversal via Photo ZIP Download

Details

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82656.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Git / github.com/admidio/admidio

Affected ranges

Type

GIT

Repo

https://github.com/admidio/admidio

Events

Introduced

Fixed

413bdaa219cb473f7db7f31c5f669955cba6795e

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.12"
        }
    ]
}

Affected versions

3.*

3.0-Beta.1

3.0-Beta.3

v3.*

v3.0.6

v3.1.5

v3.2-Beta.1

Other

v34

v4.*

v4.0-Beta.1

v4.1-Beta.2

v4.3-Beta.1

v5.*

v5.0-Beta.1

v5.0-Beta.2

v5.0-Beta.3

v5.0.0

v5.0.1

v5.0.10

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.6

v5.0.7

v5.0.8

v5.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82656.json"