Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-32756: Admidio lets authorized users upload any file type

CVE-2026-32756 · published 7 months ago

Summary

In Admidio versions up to 5.0.6, a flaw in the Documents & Files module lets a logged‑in user with upload rights bypass file‑type checks by sending an invalid security token. This can be used to place malicious scripts on the server, potentially giving an attacker control of the system. Upgrade to version 5.0.7 or later to restore proper file validation.

What to do

Update admidio admidio to version 5.0.7.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	admidio	admidio	< 5.0.7 `cpe:2.3:a:admidio:admidio::::::::`
composer	admidio	admidio	<= 5.0.6 Fix: upgrade to 5.0.7

Original advisory text

Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module

Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution on the server, resulting in full server compromise, data exfiltration, and lateral movement. This issue has been fixed in version 5.0.7.

References

https://github.com/advisories/GHSA-95cq-p4w2-32w5
https://github.com/Admidio/admidio/releases/tag/v5.0.7 URL
https://github.com/Admidio/admidio/security/advisories/GHSA-95cq-p4w2-32w5 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32756... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32756 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-434Unrestricted File Upload

Timeline

Published19 Mar 2026

Updated31 Oct 2026

First seen16 Mar 2026

Sources

GHSA-95cq-p4w2-32w5 · GHSA

CVE-2026-32756 · NVD

CVE-2026-32756 · OSV

Track software like this

Free during beta