CVE-2026-82656

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.12

Description Insufficient sanitization of album names in the photo ZIP download functionality allows authenticated users with album-creation rights to include path traversal segments in archive entry names. This enables attackers to create malicious album names containing directory traversal sequences—a technique used to access files and directories outside the intended folder—which can result in files being written outside the target directory when the recipient extracts the archive.

Recommendations Update to version 5.0.12 or later.