Admidio 5.0.18 — Security and Maintenance Update
Admidio 5.0.18 addresses several security vulnerabilities and improves reliability across member management, events, email delivery and inventory. We recommend updating to benefit from these fixes.
Security fixes
- Fixed stored cross-site scripting (XSS) vulnerabilities in confirmation dialogs and address tooltips on the role member assignment page. (#2263, #2285)
- Blocked SVG uploads to address security risks, including stored XSS through files opened from Documents & Files. Fixed path traversal in the module’s rename function. (#2268, #2281, #2298)
- Fixed missing authorization checks that allowed regular users to upload images to the announcements image store. (#2284)
- Corrected password reset handling to invalidate the account’s existing sessions and remember-me tokens. (#2282)
- Strengthened access controls for bulk profile editing and private list configurations. Category report exports now respect the configured list export policy. (#2270, #2269, #2299)
Bug fixes
- Improved event capacity enforcement for simultaneous registrations, guest counts and events sharing a participant role. Participation icons now update correctly in event tables, and event print views no longer trigger a JavaScript error. (#2300, #2301, #2274, #2273)
- Fixed missing embedded email images when using PHP
mail()with long sender domains, and corrected error reporting for rejected recipients in single-recipient sending mode. (#2256, #2252) - Restored browser validation for required single-select fields. (#2297)
- Fixed installer handling of incorrect database credentials and corrected category report schema inconsistencies that could truncate report configurations or block upgrades to version 6.0. (#2249, #2240)
Improvements and changes
- More efficient SMTP delivery: Connections are reused when sending to multiple recipients, reducing repeated connection setup and authentication. (#2255)
- More reliable inventory management: Improved MariaDB/MySQL and PostgreSQL compatibility, searching by displayed values, numeric sorting and pagination. CSV handling now preserves zero values, improves duplicate detection and supports empty exports; additional database indexes improve lookup efficiency. (#2296)
The complete v5.0.18 milestone lists all included issues and pull requests.