THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-82656 (LOW 2.6) — Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal

[NVD] CVE-2026-82656 (LOW 2.6) — Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal

mednvdPublished 2026-08-30

CVE-2026-82656 CVSS: 2.6 LOW Published: 2026-08-30T15:16:46.457

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when reci

Indicators of compromise

CVE-2026-82656cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82656