Low severity2.6NVD Advisory· Published Aug 30, 2026· Updated Aug 31, 2026

CVE-2026-82656

Description

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Admidio/Admidiollm-fuzzy
Range: <5.0.12

Patches

Vulnerability mechanics

References

github.com/Admidio/admidio/security/advisories/GHSA-gm42-rf3m-682vnvd
www.vulncheck.com/advisories/admidio-before-5.0.12-path-traversal-via-photo-zip-downloadnvd

News mentions

Admidio: Four Vulnerabilities Including SQLi and Access Control Flaws Disclosed Together
Vypr Intelligence · Aug 30, 2026

cvss	0.169
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000