CVE-2026-32756: Admidio RCE Vulnerability

CVE-2026-32756 Overview

CVE-2026-32756 is a critical unrestricted file upload vulnerability affecting Admidio, an open-source user management solution. The flaw exists in the Documents & Files module, specifically within UploadHandlerFile.php, where a design flaw in CSRF token validation and file extension verification allows authenticated users to bypass file upload restrictions. This vulnerability enables the upload of arbitrary file types, including PHP scripts, potentially leading to Remote Code Execution (RCE).

Critical Impact

Successful exploitation allows authenticated attackers to upload malicious PHP scripts, resulting in full server compromise, data exfiltration, and lateral movement within the network.

Affected Products

• Admidio versions 5.0.6 and below
• Admidio Documents & Files module
• Web servers running PHP with Admidio installations

Discovery Timeline

• 2026-03-20 - CVE-2026-32756 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-32756

Vulnerability Analysis

This vulnerability represents a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) scenario with an unusual exploitation path. The core issue lies in the flawed interaction between two security mechanisms within Admidio's upload handling logic: CSRF token validation and file extension verification.

Under normal operation, Admidio enforces file extension restrictions to prevent the upload of potentially dangerous file types such as .php, .phtml, or other executable scripts. However, when an invalid CSRF token is submitted alongside an upload request, the application's error handling creates a race condition that allows the file extension verification to be bypassed.

The vulnerability requires authentication and upload permissions within the Documents & Files module, which limits the initial attack surface. However, organizations using Admidio for user management often grant upload permissions broadly, increasing the exploitability of this flaw.

Root Cause

The root cause stems from improper error handling sequencing in UploadHandlerFile.php. The CSRF token validation and file extension verification do not fail atomically. When CSRF validation fails, the application begins an error handling routine, but the file upload operation may have already processed the file to the server's file system before the error is fully handled. This timing window allows malicious files to be persisted on disk despite the eventual CSRF error response.

This represents a Time-of-Check Time-of-Use (TOCTOU) vulnerability where the security checks are not applied in the correct order relative to the actual file write operation.

Attack Vector

The attack can be executed remotely over the network by an authenticated user with upload permissions. The attacker crafts a file upload request containing a malicious PHP script while intentionally providing an invalid CSRF token. The exploitation flow is as follows:

1. Attacker authenticates to Admidio with an account that has upload permissions
2. Attacker navigates to the Documents & Files module
3. Attacker intercepts a legitimate file upload request
4. Attacker modifies the request to include a malicious PHP payload (e.g., a web shell)
5. Attacker intentionally corrupts or removes the CSRF token
6. The file is uploaded and persisted before the CSRF validation fails
7. Attacker navigates to the uploaded PHP file to execute arbitrary commands

The attack requires no user interaction beyond the attacker's own authenticated session, making it highly practical for exploitation in real-world scenarios.

Detection Methods for CVE-2026-32756

Indicators of Compromise

• Unexpected PHP files appearing in the Documents & Files upload directory with recent timestamps
• Web server access logs showing requests to unusual .php files within upload directories
• Failed CSRF validation errors in Admidio logs followed by successful file uploads
• Evidence of web shell activity such as command execution patterns in server logs

Detection Strategies

• Monitor file system events for creation of executable file types (.php, .phtml, .php5, etc.) in upload directories
• Implement web application firewall (WAF) rules to detect file upload requests containing PHP code signatures
• Review Admidio application logs for patterns of CSRF validation failures correlated with file upload actions
• Deploy file integrity monitoring on web application directories to detect unauthorized file additions

Monitoring Recommendations

• Enable verbose logging for the Admidio application, particularly for upload operations and CSRF validation events
• Configure SIEM alerts for unusual file types being uploaded to web-accessible directories
• Implement network-based detection for outbound connections from the web server that may indicate post-exploitation activity
• Monitor for process execution anomalies on the web server, particularly PHP processes spawning shell commands

How to Mitigate CVE-2026-32756

Immediate Actions Required

• Upgrade Admidio to version 5.0.7 or later immediately, which contains the security fix for this vulnerability
• Audit the Documents & Files upload directory for any unauthorized or suspicious PHP files
• Review user accounts with upload permissions and apply the principle of least privilege
• Temporarily disable the Documents & Files module if immediate patching is not possible

Patch Information

Admidio has released version 5.0.7 which addresses this vulnerability. The patch corrects the order of operations in UploadHandlerFile.php to ensure file extension validation occurs before any file data is written to disk, and that CSRF validation failures result in immediate request termination.

Administrators should update by downloading the latest release from the Admidio v5.0.7 Release or consult the GitHub Security Advisory GHSA-95cq-p4w2-32w5 for additional details.

Workarounds

• Restrict file upload permissions to only essential personnel until patching can be completed
• Configure the web server to prevent execution of PHP files within upload directories using .htaccess or equivalent configuration
• Implement a Web Application Firewall (WAF) rule to block file uploads containing PHP code patterns
• Monitor and quarantine any new files uploaded to the Documents & Files directory pending manual review

# Apache configuration to prevent PHP execution in upload directories
# Add to .htaccess in the upload directory or server configuration
<Directory "/path/to/admidio/adm_my_files/documents">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
    php_flag engine off
</Directory>