VulnSocial

CVE-2026-32756Disclosure(admidio / admidio)

LOWCVSS 8.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch admidio admidio systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution on the server, resulting in full server compromise, data exfiltration, and lateral movement. This issue has been fixed in version 5.0.7.

admidio CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • admidio

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
admidio
Products
admidio

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-03-20: 2Patch / Workaround · 2026-03-20: 1Technical Details · 2026-03-20: 203-20
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-32756 Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module… https://www.cve.org/CVERecord?id=CVE-2026-32756

    Post summary

    The post announces that Admidio versions 5.0.6 and earlier have a critical unrestricted file upload flaw, offering a concise technical description without any mention of PoCs, exploits, patches, or active attacks.

    00000128
    56.8K followersView on X
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2026-32756: HIGH] Critical security flaw in Admidio user management solution! Versions 5.0.6 and below vulnerable to unrestricted file upload issue allowing remote code execution. Update to version 5.0....#cve,CVE-2026-32756,#cybersecurity https://cvefind.com/CVE-2026-32756

    Post summary

    The tweet announces a high‑severity remote code execution flaw in Admidio versions 5.0.6 and earlier caused by unrestricted file upload, and urges users to update to the latest version.

    0000052
    604 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appadmidioadmidio---

Explore more

Back to dashboardadmidio CVEsadmidio vulnerabilities