Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module

Vulnerability

Overview

CVE-2026-32756 is a critical unrestricted file upload vulnerability affecting the Documents & Files module of Admidio, an open-source user management solution. The root cause lies in a design flaw in UploadHandlerFile.php, where two methods, handle_form_data() and handle_file_upload(), interact during file processing. When a CSRF token validation fails in handle_form_data(), it sets a file error but does not terminate the request, leading to the file being written to disk by the parent class. The subsequent extension validation and cleanup steps are then skipped due to the error flag, allowing the uploaded file to persist on the server [1][2].

Exploitation

To exploit this vulnerability, an attacker must be an authenticated user with upload permissions in the Documents & Files module. By intentionally submitting a request with an invalid CSRF token during a file upload, the attacker triggers the flawed code path: the file is saved to disk, but the extension checking logic (allowedFileExtension()) is bypassed, and the cleanup routine that would delete the unauthorized file never executes. This means even a non-PHP file (such as a .php script) passes the upload process without rejection [2].

Impact

Successful exploitation allows the attacker to upload arbitrary file types, including executable PHP scripts. If the uploaded file is accessible via the web server (e.g., within the document root), this can lead to Remote Code Execution (RCE) on the server. The vendor notes that this could result in full server compromise, data exfiltration, and lateral movement within the network [1]. The vulnerability is rated as critical due to the ease of exploitation once authenticated and the high potential impact of RCE.

Mitigation

The issue has been fixed in Admidio version 5.0.7, released on March 19, 2026. Users running version 5.0.6 or earlier are strongly advised to update immediately [4]. No workarounds have been published, and the vulnerable versions remain affected. There is no indication that this CVE is currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but given its critical nature, patching is urgent [2].