Admidio contains a path traversal flaw in ecard_preview.php that allows an authenticated user to supply a traversal payload for the ecard_template parameter. By directing the request to files under the web server's document root, the attacker can read any file the server process can access, including configuration files that contain database credentials. The weakness is mapped to CWE-22 and results in a confidentiality compromise without affecting integrity or availability.

The flaw is present in all Admidio releases older than version 5.0.9. Admidio is an open‑source user management system applied in web environments that host the vulnerable endpoint.

The CVSS score for this vulnerability is 6.5, indicating moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. Because the attacker must be authenticated to use the endpoint, a threat actor would need legitimate credentials, but once authenticated they can read arbitrary files that the web server can access. No remote code execution or privileged escalation is offered by this flaw.