Announcements
Admidio 5.0.18 addresses several security vulnerabilities and improves reliability across member management, events, email delivery and inventory. We recommend updating to benefit from these fixes.
Security fixes
- Fixed stored cross-site scripting (XSS) vulnerabilities in confirmation dialogs and address tooltips on the role member assignment page. (#2263, #2285)
- Blocked SVG uploads to address security risks, including stored XSS through files opened from Documents & Files. Fixed path traversal in the module's rename function. (#2268, #2281, #2298)
- Fixed missing authorization checks that allowed regular users to upload images to the announcements image store. (#2284)
- Corrected password reset handling to invalidate the account's existing sessions and remember-me tokens. (#2282)
- Strengthened access controls for bulk profile editing and private list configurations. Category report exports now respect the configured list export policy. (#2270, #2269, #2299)
Bug fixes
- Improved event capacity enforcement for simultaneous registrations, guest counts and events sharing a participant role. Participation icons now update correctly in event tables, and event print views no longer trigger a JavaScript error. (#2300, #2301, #2274, #2273)
- Fixed missing embedded email images when using PHP mail() with long sender domains, and corrected error reporting for rejected recipients in single-recipient sending mode. (#2256, #2252)
- Restored browser validation for required single-select fields. (#2297)
- Fixed installer handling of incorrect database credentials and corrected category report schema inconsistencies that could truncate report configurations or block upgrades to version 6.0. (#2249, #2240)
Improvements and changes
- More efficient SMTP delivery: Connections are reused when sending to multiple recipients, reducing repeated connection setup and authentication. (#2255)
- More reliable inventory management: Improved MariaDB/MySQL and PostgreSQL compatibility, searching by displayed values, numeric sorting and pagination. CSV handling now preserves zero values, improves duplicate detection and supports empty exports; additional database indexes improve lookup efficiency. (#2296)
The complete v5.0.18 milestone lists all included issues and pull requests.
Contributors
Thank you to everyone who contributed to Admidio 5.0.18, including our team members:
- Fasse — security fixes, maintenance, code reviews and release coordination.
- MightyMCoder — inventory improvements, form validation fixes, testing and security-related code reviews.
- jhoos70 — email delivery improvements, email bug fixes and event display and printing fixes.
- kainhofer — investigation and fixes for category report database schema and upgrade issues.
- pboosten — confirmation and troubleshooting of the embedded email image issue.
We also thank everyone who reported security vulnerabilities and bugs, tested changes or supported the release through community feedback.
On October 21, 2026, two critical security vulnerabilities were disclosed in PHP (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities may allow attackers to execute malicious code on affected servers.
Admidio itself is not affected by these vulnerabilities. However, since Admidio runs on PHP, the PHP installation on your web server may be vulnerable.
We strongly recommend that all Admidio administrators check their PHP version and ensure that their hosting environment has been updated.
How to check your PHP version in Admidio
You can easily find the PHP version used by your Admidio installation:
- Log in to Admidio as an administrator.
- Navigate to Settings → Information → PHP.
- Check the PHP version displayed on this page.
Which PHP versions are secure?
The following PHP versions include the security fixes for both vulnerabilities:
| PHP Branch | Patched Version |
|---|---|
| PHP 8.5 | 8.5.12 or newer |
| PHP 8.4 | 8.4.27 or newer |
| PHP 8.3 | 8.3.36 or newer |
| PHP 8.2 | 8.2.35 or newer |
Older PHP versions, including PHP 8.1 and earlier, are no longer officially supported and should be replaced with a supported version.
Note: Some hosting providers may provide security fixes through backported patches without changing the displayed PHP version.
What should you do?
If your server is running an affected PHP version, please contact your hosting provider or update PHP through your hosting control panel as soon as possible.
Updating Admidio alone will not resolve these vulnerabilities, as they are located in PHP itself, not in the Admidio application.
For further information, please refer to the official PHP security advisory.
The Admidio Team
This release contains several bug fixes, improvements and security-related changes since Admidio 5.0.16.
Security
Security is an important part of this release. Two issues have been fixed to improve the protection of server files and prevent unauthorized changes to event registrations.
- Improved security when sending eCards
Fixed a vulnerability that could allow authenticated users to access local server files through images embedded in eCard messages. - Improved validation of event registrations
Fixed an issue where members could register additional guests even when this option was disabled, potentially exceeding event capacity and preventing other members from registering.
You can find more information here:
https://github.com/Admidio/admidio/security
Bug Fixes
- Fixed an issue where dynamically loaded buttons did not correctly submit CSRF tokens, affecting actions such as creating new contacts.
- Fixed an issue where rejected chunked file uploads could be repeated indefinitely without displaying an error message.
- Fixed an issue where certain Docker environment variables, including ADMIDIO_LOGIN_FOR_UPDATE and ADMIDIO_PASSWORD_HASH_ALGORITHM, were not applied correctly.
- Fixed an issue that could cause duplicate entries to appear when adding participants to events.
- Corrected several typos and inconsistent translations in the German language files.
Improvements
- Updated MIME type definitions for various audio, video and Microsoft Office file formats to improve compatibility with browsers and downloads.
- Improved error handling for large file uploads to ensure that rejected uploads are stopped and appropriate error messages are displayed.
Further Information
We recommend you to read our announcements for version 5 if you have not done so already:
https://www.admidio.org/dokuwiki/doku.php?id=en:2.0:announcement_v5
A full list of all new features and bug fixes can be found in our [issue tracker for version 5.0.17](https://github.com/Admidio/admidio/issues?q=is%3Aclosed%20milestone%3A%22v5.0.17%22).
Full Changelog:
https://github.com/Admidio/admidio/compare/v5.0.16..v5.0.17
If you are new to Admidio and want to install it on your website, the following wiki page could help you:
https://www.admidio.org/dokuwiki/doku.php?id=en:2.0:installation
The following wiki page may be interesting when updating an existing installation:
https://www.admidio.org/dokuwiki/doku.php?id=en:2.0:update
Contributors
A big thank you to everyone who contributed to this release by reporting bugs, suggesting improvements, or providing fixes.
Special thanks to:
Your contributions help make Admidio better with every release. Thank you for your support!
This release contains several bug fixes, improvements and security-related changes since Admidio 5.0.14.
Security
Security is an important part of this release. Several access control issues have been fixed to ensure that users can only access or modify data for which they have the required permissions.
- Improved access control for PDF landscape exports
Fixed an authorization issue where PDF landscape exports were not checked properly against the user's permissions. - Improved access control in the Inventory module
Fixed several issues that could allow users to access inventory data even when the Inventory module was disabled or the required permissions were missing. - Improved authorization checks in the Forum module
Fixed an issue that could allow authenticated users to modify forum topics created by other users. - Improved access control for list exports
Fixed an authorization bypass where the PDF landscape export mode was not properly included in the permission checks for list exports. - Improved access control for Weblinks RSS feeds
Fixed an issue where links from role-restricted categories could be exposed through the RSS feed to unauthenticated users.
You can find more information here:
https://github.com/Admidio/admidio/security
Bug Fixes
- Fixed an error when reloading current role memberships on profiles without active roles.
- Fixed the global contacts search when date or timestamp columns are used with databases configured with utf8mb4.
- Fixed an issue where the email field was not displayed correctly during registration.
- Fixed errors that could occur when updating older Admidio installations from versions 4.1 or 4.3 to Admidio 5.0.
- Fixed various other issues reported by the community.
Improvements
- Added support for additional modern media, image and archive formats, including m4a, m4v, mkv, flac, ogg, opus, 7z, rar, webp, heic, heif and svg.
- Added chunked file uploads to improve the reliability of large file uploads, especially on servers with restrictive PHP or proxy upload limits.
- Improved upload handling to ensure database entries, notifications and photo processing are only triggered after a complete file has been uploaded.
- Updated several third-party libraries.
- Improved the mobile menu layout and accessibility.
Further Information
A full list of all bugfixes can be found in our issue tracker!
We recommend you to read our announcements for version 5 if you have not done before.
If you are new to Admidio and want to install it on your webpage than the following wikipage could help: Install Admidio
The following wiki pages maybe interesting on an Update: Update Admidio
The Admidio Team
This release contains several bug fixes, improvements and security-related changes since Admidio 5.0.14.
Security
Security is an important part of this release. Security-related issues are highlighted separately so that administrators can quickly identify the relevant changes.
- Redirect not protected against invalid URL
Improved the protection of redirects to prevent invalid URLs from being used. - Objects of other organizations could be read
Fixed an access control issue that could allow objects belonging to other organizations to be read. - Output of database fields not checked properly against HTML content
Improved the validation and output handling of database fields to prevent HTML content from being processed incorrectly.
You can find more information here:
https://github.com/Admidio/admidio/security
Bug Fixes
- Fixed an issue with system notifications after deleting an email text.
- Fixed an issue in the Messages module when creating or editing messages.
- Fixed an error in messages_write.php.
- Fixed incorrect file extensions when downloading iCal files with Chrome and Safari.
- Fixed several issues in the Documents & Files module.
- Improved the handling of uploaded and unmanaged files.
- Fixed various other issues reported by the community.
Improvements
- Added support for additional OpenDocument file types.
- Improved compatibility when downloading calendar files with different browsers.
- Improved the reliability of system notifications and message handling.
Further Information
A full list of all bugfixes can be found in our issue tracker!
We recommend you to read our announcements for version 5 if you have not done before.
If you are new to Admidio and want to install it on your webpage than the following wikipage could help: Install Admidio
The following wiki pages maybe interesting on an Update: Update Admidio
The Admidio Team
Over the past six months, several Admidio releases have included fixes for security-related issues. We understand that seeing security advisories mentioned repeatedly in our release notes may raise questions, so we would like to explain the background.
The growing role of AI in finding security vulnerabilities
The number of security vulnerabilities being discovered in software has generally increased in recent years. One important factor is the growing use of artificial intelligence (AI) to analyze source code and identify potential security weaknesses.
AI-assisted tools can examine large codebases quickly and systematically. They can detect patterns, unusual code paths, missing validation, or other potential weaknesses that might previously have required significant manual effort to discover.
This development affects software projects across the industry – including Admidio.
It is important to emphasize that this does not mean that Admidio has suddenly become less secure. Rather, vulnerabilities that may have remained unnoticed for a long time can now be identified more quickly and systematically. At the same time, the increased attention on security helps us improve the overall security of Admidio.
Security issues are being addressed quickly
Whenever a security issue is reported to us, we investigate it carefully, develop an appropriate fix, and release the fix as soon as possible.
We document confirmed security issues publicly in our GitHub Security Advisories:
There you can find an overview of the security vulnerabilities that have been identified and fixed in Admidio.
Our goal is to respond quickly to security reports while ensuring that the resulting fixes are thoroughly tested and do not introduce new problems.
Please keep your Admidio installation up to date
We strongly recommend that all Admidio administrators install the latest bugfix release available for their version of Admidio.
Bugfix releases do not only contain general bug fixes. As recent releases have shown, they may also contain important security fixes.
Keeping Admidio up to date is therefore one of the most important steps you can take to protect your installation.
Thank you to everyone who reports security issues responsibly and helps us make Admidio safer. We will continue to monitor the project closely, respond to reported vulnerabilities as quickly as possible, and provide updated releases whenever necessary.
This release focuses on improving the overall stability and reliability of Admidio. It includes several bug fixes across different modules, improves compatibility, and resolves a number of edge cases reported by the community. As always, we recommend updating to the latest version to benefit from these improvements.
Due to some problems within version 5.0.12 and 5.0.13 we have directly released version 5.0.14.
You can find more information here: https://github.com/Admidio/admidio/security
A full list of all bugfixes can be found in our issue tracker!
We recommend you to read our announcements for version 5 if you have not done before.
If you are new to Admidio and want to install it on your webpage than the following wikipage could help: Install Admidio
The following wiki pages maybe interesting on an Update:
Update Admidio
The Admidio Team
Subscribe to events and performance improvements within the inventory module. Also fixes several bugs and some security vulnerabilities.
You can find more information here: https://github.com/Admidio/admidio/security
A full list of all bugfixes can be found in our issue tracker!
We recommend you to read our announcements for version 5 if you have not done before.
If you are new to Admidio and want to install it on your webpage than the following wikipage could help: Install Admidio
The following wiki pages maybe interesting on an Update:
Update Admidio
The Admidio Team
This version fixes several bugs and also some security vulnerabilities. For this reason, we strongly recommend updating to version 5.0.10.
You can find more information here: https://github.com/Admidio/admidio/security
A full list of all bugfixes can be found in our issue tracker!
We recommend you to read our announcements for version 5 if you have not done before.
If you are new to Admidio and want to install it on your webpage than the following wikipage could help: Install Admidio
The following wiki pages maybe interesting on an Update:
Update Admidio
The Admidio Team
This version fixes several bugs and also some security vulnerabilities. For this reason, we strongly recommend updating to version 5.0.9.
You can find more information here: https://github.com/Admidio/admidio/security
A full list of all bugfixes can be found in our issue tracker!
We recommend you to read our announcements for version 5 if you have not done before.
If you are new to Admidio and want to install it on your webpage than the following wikipage could help: Install Admidio
The following wiki pages maybe interesting on an Update:
Update Admidio
The Admidio Team