Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

Vulnerability

Overview

CVE-2026-32757 is a server-side HTML injection vulnerability in the eCard feature of Admidio, an open-source user management system. The root cause is a coding error in ecard_send.php: the raw $_POST['ecard_message'] value is captured on line 38 before form validation runs, and this unsanitized value is later passed to parseEcardTemplate() on lines 159 and 201. The properly HTMLPurifier-sanitized value stored in $formValues['ecard_message'] is never used for the email content [1][2].

Exploitation and

Attack Surface

An authenticated attacker can craft a malicious ecard_message payload containing arbitrary HTML and JavaScript. Because the raw POST value bypasses HTMLPurifier, the injected content is placed directly into the greeting card HTML template without any encoding—unlike recipient fields which are properly encoded via SecurityUtils::encodeHTML() [2]. The attacker then sends the eCard to any member or role, and the malicious content is delivered to the recipient's email client. No special network position is required beyond a valid login [1].

Impact

Successful exploitation allows an attacker to inject phishing content, fake login forms, or other social engineering attacks into legitimate-looking greeting card emails. Since the email originates from the trusted Admidio trusted Admidio server, recipients are more likely to trust the content, increasing the effectiveness of the attack. The vulnerability crosses from the web application into the email client, potentially compromising other users' credentials or sensitive information [1][2].

Mitigation

The vulnerability is fixed in Admidio version 5.0.7, released on 2026-03-19 [4]. Users running 5.0.6 or earlier should upgrade immediately. No workaround is documented; the fix ensures the sanitized $formValues['ecard_message'] is used instead of the raw POST value [2].