CVE-2026-32756

Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution on the server, resulting in full server compromise, data exfiltration, and lateral movement. This issue has been fixed in version 5.0.7.

Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution on the server, resulting in full server compromise, data exfiltration, and lateral movement. This issue has been fixed in version 5.0.7.

Summary

A critical unrestricted file upload vulnerability exists in the Documents & Files module of Admidio. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution (RCE) on the server.

Details

1. Critical - Unrestricted File Upload leading to Remote Code Execution (RCE)

Root Cause Analysis:

The root cause lies in a design flaw in src/Infrastructure/Plugins/UploadHandlerFile.php. The UploadHandlerFile class overrides two methods from its parent UploadHandler class:

• handle_form_data($file, $index) — Validates the CSRF token. On failure, it sets $file->error and returns. The request is not terminated.
• handle_file_upload(...) — Calls parent::handle_file_upload() to physically write the file to disk, then checks if (!isset($file->error)) before running file extension validation (allowedFileExtension()).

The execution flow differs based on whether the CSRF token is valid:

• Valid CSRF token: handle_form_data() does not set an error → extension check runs → invalid extension causes the uploaded file to be deleted from disk.
• Invalid CSRF token: handle_form_data() sets $file->error → the if (!isset($file->error)) guard in handle_file_upload() causes the extension validation to be skipped entirely → the cleanup code (FileSystemUtils::deleteFileIfExists()) is never reached → the file, already written to disk by the parent class, remains on the server and is directly accessible.

In summary, the file is always saved to disk by the parent class first. The extension check and cleanup only execute when no prior error exists. A deliberate CSRF token failure bypasses the extension filter while the file remains on disk.

Affected code (src/Infrastructure/Plugins/UploadHandlerFile.php):

// File is physically saved to disk here, before any Admidio-specific checks
$file = parent::handle_file_upload($uploaded_file, $name, $size, $type, $error, $index, $content_range);

if (!isset($file->error)) {
    // Extension validation is only reached when no prior error is set.
    // If CSRF validation failed in handle_form_data(), this block is skipped
    // and the uploaded file is never cleaned up from disk.
    if (!$newFile->allowedFileExtension()) {
        throw new Exception('SYS_FILE_EXTENSION_INVALID');
    }
}

PoC

Documents & Files Create folder <img width="762" height="729" alt="image" src="https://github.com/user-attachments/assets/2c927482-851b-4945-93d6-6e7a1e3bc21f" />

<img width="749" height="690" alt="image" src="https://github.com/user-attachments/assets/72443c87-e15f-4312-9659-8cd0661a4dae" />

File Upload Try 1-1 (before request) <img width="1856" height="635" alt="image" src="https://github.com/user-attachments/assets/d1ffaa12-aec1-45ff-a612-885d9554fb60" />

File Upload Try 1-2 (after request) <img width="1850" height="855" alt="image" src="https://github.com/user-attachments/assets/4ece4aac-1255-4189-9048-45ff3df4abcf" />

File Upload Try 1-3 (After changing CSRF to a test value, request → PHP file upload succeeds) <img width="1847" height="928" alt="image" src="https://github.com/user-attachments/assets/63f9d108-5e4f-4d32-96d2-09f9ad910873" />

✅ rcepoc.php Upload Success! <img width="926" height="814" alt="image" src="https://github.com/user-attachments/assets/4de99c31-dc3c-44f2-9936-19c3da0dfffb" />

Access the rcepoc upload path confirmed in the response and check the web shell. <img width="1635" height="922" alt="image" src="https://github.com/user-attachments/assets/0b770caf-e737-4cbd-97b9-ae191a8b79f5" />

🆗 WebShell Success <img width="685" height="187" alt="image"…

Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution on the server, resulting in full server compromise, data exfiltration, and lateral movement. This issue has been fixed in version 5.0.7.

Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution on the server, resulting in full server compromise, data exfiltration, and lateral movement. This issue has been fixed in version 5.0.7.

Summary

A critical unrestricted file upload vulnerability exists in the Documents & Files module of Admidio. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution (RCE) on the server.

Details

1. Critical - Unrestricted File Upload leading to Remote Code Execution (RCE)

Root Cause Analysis:

The root cause lies in a design flaw in src/Infrastructure/Plugins/UploadHandlerFile.php. The UploadHandlerFile class overrides two methods from its parent UploadHandler class:

• handle_form_data($file, $index) — Validates the CSRF token. On failure, it sets $file->error and returns. The request is not terminated.
• handle_file_upload(...) — Calls parent::handle_file_upload() to physically write the file to disk, then checks if (!isset($file->error)) before running file extension validation (allowedFileExtension()).

The execution flow differs based on whether the CSRF token is valid:

• Valid CSRF token: handle_form_data() does not set an error → extension check runs → invalid extension causes the uploaded file to be deleted from disk.
• Invalid CSRF token: handle_form_data() sets $file->error → the if (!isset($file->error)) guard in handle_file_upload() causes the extension validation to be skipped entirely → the cleanup code (FileSystemUtils::deleteFileIfExists()) is never reached → the file, already written to disk by the parent class, remains on the server and is directly accessible.

In summary, the file is always saved to disk by the parent class first. The extension check and cleanup only execute when no prior error exists. A deliberate CSRF token failure bypasses the extension filter while the file remains on disk.

Affected code (src/Infrastructure/Plugins/UploadHandlerFile.php):

// File is physically saved to disk here, before any Admidio-specific checks
$file = parent::handle_file_upload($uploaded_file, $name, $size, $type, $error, $index, $content_range);

if (!isset($file->error)) {
    // Extension validation is only reached when no prior error is set.
    // If CSRF validation failed in handle_form_data(), this block is skipped
    // and the uploaded file is never cleaned up from disk.
    if (!$newFile->allowedFileExtension()) {
        throw new Exception('SYS_FILE_EXTENSION_INVALID');
    }
}

PoC

Documents & Files Create folder <img width="762" height="729" alt="image" src="https://github.com/user-attachments/assets/2c927482-851b-4945-93d6-6e7a1e3bc21f" />

<img width="749" height="690" alt="image" src="https://github.com/user-attachments/assets/72443c87-e15f-4312-9659-8cd0661a4dae" />

File Upload Try 1-1 (before request) <img width="1856" height="635" alt="image" src="https://github.com/user-attachments/assets/d1ffaa12-aec1-45ff-a612-885d9554fb60" />

File Upload Try 1-2 (after request) <img width="1850" height="855" alt="image" src="https://github.com/user-attachments/assets/4ece4aac-1255-4189-9048-45ff3df4abcf" />

File Upload Try 1-3 (After changing CSRF to a test value, request → PHP file upload succeeds) <img width="1847" height="928" alt="image" src="https://github.com/user-attachments/assets/63f9d108-5e4f-4d32-96d2-09f9ad910873" />

✅ rcepoc.php Upload Success! <img width="926" height="814" alt="image" src="https://github.com/user-attachments/assets/4de99c31-dc3c-44f2-9936-19c3da0dfffb" />

Access the rcepoc upload path confirmed in the response and check the web shell. <img width="1635" height="922" alt="image" src="https://github.com/user-attachments/assets/0b770caf-e737-4cbd-97b9-ae191a8b79f5" />

🆗 WebShell Success <img width="685" height="187" alt="image"…