8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32756

CVE-2026-32756: Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module

Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution on the server, resulting in full server compromise, data exfiltration, and lateral movement. This issue has been fixed in version 5.0.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32756

CVE-2026-32756:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
admidio/admidio	composer	<= 5.0.6	5.0.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a critical design flaw in Admidio's file upload handling mechanism, specifically within the UploadHandlerFile.php and UploadHandlerPhoto.php classes. The root cause is the improper separation of concerns between CSRF token validation and file type validation.

The process unfolds in two steps, handled by two different methods:

handle_form_data: This method validates the CSRF token. If the token is invalid, it sets an error flag on the file object ($file->error) but crucially, does not terminate the script's execution.
handle_file_upload: This method is called subsequently. It first invokes its parent method, which saves the uploaded file to a temporary directory on the server. It then checks if the $file->error flag is set. In the vulnerable version, if the flag is set, the entire logic block for file validation (including checking for allowed extensions) and processing is skipped.

An attacker can exploit this by intentionally submitting a file upload request with a malicious file (e.g., a PHP shell) and an invalid CSRF token. The handle_form_data method flags the error, and handle_file_upload proceeds to save the file but then skips the security check that would have identified the dangerous file type. The function then concludes without deleting the uploaded file, leaving the webshell on the server and accessible for remote code execution.

The patch corrects this flaw by restructuring the handle_file_upload method. It wraps the entire process in a try...catch block. It now immediately checks for the CSRF error after the file is uploaded and, if present, throws an exception. This exception is caught by the catch block, which ensures that the temporary file is always deleted, regardless of the reason for the failure. This guarantees that no file is left on the server if any part of the validation process fails.

Vulnerable functions

UploadHandlerFile::handle_file_upload

src/Infrastructure/Plugins/UploadHandlerFile.php

This function contains the primary logic flaw. It first calls its parent method to save the uploaded file to a temporary location. It then checks if an error has been set on the file object (e.g., by `handle_form_data` due to a CSRF token mismatch). If an error is present, it completely skips the code block containing the file extension validation. Because the file has already been written to disk and the cleanup logic is also skipped, the malicious file remains on the server, leading to RCE.

UploadHandlerFile::handle_form_data

src/Infrastructure/Plugins/UploadHandlerFile.php

This function is the entry point for the vulnerability. It validates the CSRF token. Upon failure, it sets an error message on the `$file` object but does not terminate the request. This allows execution to proceed to `handle_file_upload`, which then incorrectly interprets the error flag and bypasses the file extension security check. While not changed in the patch, its behavior is the trigger for the vulnerability.

UploadHandlerPhoto::handle_file_upload

src/Infrastructure/Plugins/UploadHandlerPhoto.php

This function suffers from the same design flaw as its counterpart in `UploadHandlerFile`. The patch applies an identical fix, indicating that it was also vulnerable. An invalid CSRF token would cause `handle_form_data` to set an error, and this function would then skip the image validation and processing logic, leaving the originally uploaded (and potentially malicious) file on the server.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.