CyberRota Analysis
AI-GeneratedAdmidio versions prior to 5.0.12 are vulnerable due to inadequate sanitization of album names in the photo ZIP download feature, allowing authenticated users with album-creation rights to exploit path traversal vulnerabilities. This could enable attackers to craft malicious album names that, when extracted, may lead to unauthorized file writes outside the intended directory. Organizations using affected versions should prioritize updating to mitigate potential risks associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that escape the intended directory when recipients extract the archive, potentially writing files outside the target directory.