CVE-2026-32756 - Vulnerability Analysis

Overview

Admidio <= 5.0.6 contains an unrestricted file upload vulnerability caused by flawed CSRF token validation and file extension checks in UploadHandlerFile.php, letting authenticated users with upload permissions upload arbitrary files including PHP scripts, exploit requires valid upload permissions and intentional invalid CSRF token submission.

Severity & Score

Impact

Authenticated users can upload arbitrary files, potentially leading to remote code execution and full server compromise.

Mitigation

Upgrade to version 5.0.7 or later.

References

• https://github.com/Admidio/admidio/releases/tag/v5.0.7
• https://github.com/Admidio/admidio/security/advisories/GHSA-95cq-p4w2-32w5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner