Vulnerability · Published Mar 19, 2026 · Assigned by GitHub_M

CVE-2026-32757Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection

Medium 5.4

In plain English

A medium-severity cross-site scripting in admidio from Admidio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 85.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] value instead of the HTMLPurifier-sanitized $formValues['ecard_message'] when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent to other members, bypassing the server-side HTMLPurifier sanitization that is properly applied to the ecard_message field during form validation. An attack can result in any member or role receiving phishing content that appears legitimate, crossing from the web application into recipients' email clients. This issue has been fixed in version 5.0.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	admidio/admidio	5.0.7	GHSA-4wr4-f2qf-x5wj

Affected products (as reported)

Vendor	Product	Versions
Admidio	admidio	< 5.0.7

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/Admidio/admidio/security/advisories/GHSA-4wr4-f2qf-x5wj x_refsource_CONFIRM
https://github.com/Admidio/admidio/releases/tag/v5.0.7 x_refsource_MISC