Announcements

Admidio 5.0.18 addresses several security vulnerabilities and improves reliability across member management, events, email delivery and inventory. We recommend updating to benefit from these fixes.

Security fixes

• Fixed stored cross-site scripting (XSS) vulnerabilities in confirmation dialogs and address tooltips on the role member assignment page. (#2263, #2285)
• Blocked SVG uploads to address security risks, including stored XSS through files opened from Documents & Files. Fixed path traversal in the module's rename function. (#2268, #2281, #2298)
• Fixed missing authorization checks that allowed regular users to upload images to the announcements image store. (#2284)
• Corrected password reset handling to invalidate the account's existing sessions and remember-me tokens. (#2282)
• Strengthened access controls for bulk profile editing and private list configurations. Category report exports now respect the configured list export policy. (#2270, #2269, #2299)

Bug fixes

• Improved event capacity enforcement for simultaneous registrations, guest counts and events sharing a participant role. Participation icons now update correctly in event tables, and event print views no longer trigger a JavaScript error. (#2300, #2301, #2274, #2273)
• Fixed missing embedded email images when using PHP mail() with long sender domains, and corrected error reporting for rejected recipients in single-recipient sending mode. (#2256, #2252)
• Restored browser validation for required single-select fields. (#2297)
• Fixed installer handling of incorrect database credentials and corrected category report schema inconsistencies that could truncate report configurations or block upgrades to version 6.0. (#2249, #2240)

Improvements and changes

• More efficient SMTP delivery: Connections are reused when sending to multiple recipients, reducing repeated connection setup and authentication. (#2255)
• More reliable inventory management: Improved MariaDB/MySQL and PostgreSQL compatibility, searching by displayed values, numeric sorting and pagination. CSV handling now preserves zero values, improves duplicate detection and supports empty exports; additional database indexes improve lookup efficiency. (#2296)

The complete v5.0.18 milestone lists all included issues and pull requests.

Contributors

Thank you to everyone who contributed to Admidio 5.0.18, including our team members:

• Fasse — security fixes, maintenance, code reviews and release coordination.
• MightyMCoder — inventory improvements, form validation fixes, testing and security-related code reviews.
• jhoos70 — email delivery improvements, email bug fixes and event display and printing fixes.
• kainhofer — investigation and fixes for category report database schema and upgrade issues.
• pboosten — confirmation and troubleshooting of the embedded email image issue.

We also thank everyone who reported security vulnerabilities and bugs, tested changes or supported the release through community feedback.