Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection
Date: 2026-03
Affected: composer/admidio/admidio
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-32755
CVE-2026-32757
CVE-2026-32812
CVE-2026-32816
CWE: CWE-352
CWE-79
CWE-918
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

## Summary The eCard send handler in Admidio uses the raw `$_POST['ecard_message']` value instead of the HTMLPurifier-sanitized `$formValues['ecard_message']` when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent to other members, bypassing the server-side HTMLPurifier sanitization that is properly applied to the `ecard_message` field during form validation. ## Details ### Root Cause File: `D:\bugcrowd\admidio\repo\modules\photos\ecard_send.php` At line 38, the raw POST value is captured BEFORE form validation runs: ```php $postMessage = $_POST['ecard_message']; // Line 38: RAW value ``` At line 61, the form validation runs and properly sanitizes the message through HTMLPurifier (since ecard_message is registered as an editor field): ```php $formValues = $photosEcardSendForm->validate($_POST); // Line 61: sanitized ``` The sanitized value is stored in `$formValues['ecard_message']`, but this value is never used. Instead, the raw `$postMessage` is passed to `parseEcardTemplate()` at lines 159 and 201: ```php $ecardHtmlData = $funcClass->parseEcardTemplate($imageUrl, $postMessage, ...); // Line 159 $ecardHtmlData = $funcClass->parseEcardTemplate($imageUrl, $postMessage, ...); // Line 201 ``` ### Template Injection File: `D:\bugcrowd\admidio\repo\src\Photos\ValueObject\ECard.php`, line 144 The `parseEcardTemplate()` method places the message directly into the HTML te


Mitigations:

Architectural layers (MAESTRO):