Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights… (CVE-2026-82656)

Admidio before version 5.0.12 fails to sanitize album names in the photo ZIP download feature, enabling authenticated users with album-creation permissions to insert directory traversal sequences into archive entry names. This CWE-22 (Path Traversal) vulnerability can cause files to be extracted outside the target directory when the ZIP archive is unpacked. The CVSS 3.1 base score is 2.6, reflecting low impact with network attack vector, high attack complexity, low privileges required, and user interaction needed. No patch links or vendor advisories are provided, and no known exploitation has been reported.

An attacker with authenticated album-creation rights can craft album names containing directory traversal sequences that cause files to be written outside the intended extraction directory when the ZIP archive is unpacked. This may lead to limited integrity impact by overwriting or placing files in unintended locations. There is no confidentiality or availability impact reported. The overall severity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict album-creation rights to trusted users only and carefully validate or sanitize album names before use in ZIP archive creation.