CVE-2026-32756highCWE-434

CVE-2026-32756: fallo de gravedad alta en admidio

Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear admidio+ Monitorear admidio/admidio

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 1.0%
Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution on the server, resulting in full server compromise, data exfiltration, and lateral movement. This issue has been fixed in version 5.0.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Admidio · admidio
CVEs relacionadas — admidio

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-43810HIGHCross-site Scripting (XSS) when redirect an urlEPSS 5.1%CVE-2021-32630CRITICALVariousEPSS 1.6%CVE-2020-11004HIGHSQL Injection in AdmidioEPSS 1.5%CVE-2024-38529CRITICALAdmidio Vulnerable to RCE via Arbitrary File Upload in Message AttachmentEPSS 1.2%CVE-2024-37906CRITICALAdmidio has Blind SQL Injection in ecard_send.phpEPSS 0.9%CVE-2026-69091HIGHAdmidio before 5.0.11 Authentication Bypass via forum.phpEPSS 0.6%