Description

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.6",
  "pubDate": "2026-08-30T15:16:46.457Z",
  "pubdate": "2026-08-30T15:16:46.457Z",
  "executiveSummary": "This vulnerability is a path traversal flaw residing in the photo ZIP download functionality of Admidio versions prior to 5.0.12.\nThe issue arises from insufficient sanitization of user-supplied album names, which are utilized as entry names within generated ZIP archives.\nAn authenticated attacker possessing album-creation privileges can craft malicious album names containing directory traversal sequences (e.g., ../).\nUpon extraction of the generated archive by a victim, these traversal sequences can cause files to be written outside the intended destination directory, potentially leading to arbitrary file write or overwriting of sensitive system or application files.\nThe vulnerability requires an authenticated attacker with specific existing permissions to create albums.\nThe risk is significant as it facilitates unauthorized filesystem access and potential remote code execution (RCE) scenarios depending on the target system's environment and the files overwritten during extraction.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special elements in the path manipulation functionality within the Admidio photo ZIP download component. When a user requests a ZIP download of an album, the application constructs the archive entries using the album name as a base directory or file identifier without adequate validation.\nExploitation is feasible for any authenticated user holding album-creation rights. The attack flow begins by the attacker creating or renaming an album to include directory traversal sequences, such as '../../' or absolute path indicators. When the application logic processes the request to bundle these photo albums into a ZIP archive, it incorporates these tainted strings directly into the archive file's metadata structure for the entry names.\nThe vulnerability manifests during the archive extraction process. When a user—typically an administrator or a user with elevated privileges—extracts the malicious ZIP file, the client-side extraction utility (or server-side extraction process if applicable) interprets the traversal sequences. This causes the file system to resolve paths outside of the intended extraction directory. If an attacker crafts the archive structure appropriately, they can force the extraction process to write files into sensitive locations on the file system, such as web root directories, configuration folders, or system binary paths.\nThis behavior constitutes a classic 'ZipSlip' style vulnerability. The impact post-exploitation is contingent upon the permissions of the user performing the extraction and the target system's directory structure. If an application configuration file is overwritten with malicious data, an attacker might achieve persistence or gain further unauthorized access. If a executable file or script within the web application root is overwritten with malicious code, the attacker could successfully achieve remote code execution, leading to complete compromise of the application and potentially the underlying server.\nThe vulnerability affects all Admidio instances prior to version 5.0.12 that utilize the photo album ZIP functionality. The flaw is specifically tied to the lack of filename sanitization before the entry is added to the ZIP stream, failing to normalize or strip characters that define filesystem navigation."
}