Vulnerability Description
Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] value instead of the HTMLPurifier-sanitized $formValues['ecard_message'] when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent to other members, bypassing the server-side HTMLPurifier sanitization that is properly applied to the ecard_message field during form validation. An attack can result in any member or role receiving phishing content that appears legitimate, crossing from the web application into recipients' email clients. This issue has been fixed in version 5.0.7.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Admidio | Admidio | < 5.0.7 |
Related Weaknesses (CWE)
References
- https://github.com/Admidio/admidio/releases/tag/v5.0.7Release Notes
- https://github.com/Admidio/admidio/security/advisories/GHSA-4wr4-f2qf-x5wjExploitMitigationVendor Advisory
FAQ
What is CVE-2026-32757?
CVE-2026-32757 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] value instead of the HTMLPurifier-sanitized $formValues['ecar...
How severe is CVE-2026-32757?
CVE-2026-32757 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-32757?
Check the references section above for vendor advisories and patch information. Affected products include: Admidio Admidio.