CVE-2026-32756

CVSS v3.1

8.8

Vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

A critical unrestricted file upload vulnerability exists in the Documents & Files module of Admidio. Due to a design flaw in how CSRF token validation and file extension verification interact within

UploadHandlerFile.php

, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution (RCE) on the server.

Details

1. Critical - Unrestricted File Upload leading to Remote Code Execution (RCE)

Root Cause Analysis:

The root cause lies in a design flaw in

src/Infrastructure/Plugins/UploadHandlerFile.php

. The

UploadHandlerFile

class overrides two methods from its parent

UploadHandler

class:

```
handle form data($file, $index)
```
— Validates the CSRF token. On failure, it sets
```
$file->error
```
and returns. The request is not terminated.
```
handle file upload(...)
```
— Calls
```
parent::handle file upload()
```
to physically write the file to disk, then checks
```
if (!isset($file->error))
```
before running file extension validation (
```
allowedFileExtension()
```
).

The execution flow differs based on whether the CSRF token is valid:

Valid CSRF token:
```
handle form data()
```
does not set an error → extension check runs → invalid extension causes the uploaded file to be deleted from disk.
Invalid CSRF token:
```
handle form data()
```
sets
```
$file->error
```
→ the
```
if (!isset($file->error))
```
guard in
```
handle file upload()
```
causes the extension validation to be skipped entirely → the cleanup code (
```
FileSystemUtils::deleteFileIfExists()
```
) is never reached → the file, already written to disk by the parent class, remains on the server and is directly accessible.

In summary, the file is always saved to disk by the parent class first. The extension check and cleanup only execute when no prior error exists. A deliberate CSRF token failure bypasses the extension filter while the file remains on disk.

Affected code (

src/Infrastructure/Plugins/UploadHandlerFile.php

// File is physically saved to disk here, before any Admidio-specific checks
$file = parent::handle file upload($uploaded file, $name, $size, $type, $error, $index, $content range);

if (!isset($file->error)) {
  // Extension validation is only reached when no prior error is set.
  // If CSRF validation failed in handle form data(), this block is skipped
  // and the uploaded file is never cleaned up from disk.
  if (!$newFile->allowedFileExtension()) {
    throw new Exception('SYS FILE EXTENSION INVALID');
  }
}

PoC

Documents & Files Create folder

File Upload Try 1-1 (before request)

File Upload Try 1-2 (after request)

File Upload Try 1-3 (After changing CSRF to a test value, request → PHP file upload succeeds)

✅ rcepoc.php Upload Success!

Access the rcepoc upload path confirmed in the response and check the web shell.

🆗 WebShell Success

Steps to Reproduce:

Log in to Admidio as an authenticated user with upload permissions on the Documents & Files module.
Navigate to a folder in the Documents & Files module and open the file upload dialog.

Intercept the upload POST request to

/system/file upload.php?module=documents files&mode=upload files&uuid=<folder uuid>

using a proxy tool such as Burp Suite.

Replace the value of the
```
adm csrf token
```
field with an arbitrary invalid string (e.g.,
```
webshellgogo
```
).
Set the file to be uploaded to a PHP webshell (e.g.,
```
<?php system($ GET[1]); ?>
```
).
Forward the modified request.
Observe that the server responds with HTTP
```
200 OK
```
. The JSON body contains
```
"error":"Invalid or missing CSRF token!"
```
, yet the file is physically present on the server at the path indicated in the
```
url
```
field.
Access the uploaded PHP file directly via the URL provided in the response — arbitrary command execution is confirmed.

Impact

An authenticated attacker with upload permissions can bypass file extension validation and upload arbitrary server-side scripts such as PHP webshells.
This leads to Remote Code Execution (RCE), potentially resulting in full server compromise, sensitive data exfiltration, and lateral movement.
While authentication is required, the attack is not limited to administrators — any member granted upload rights may exploit this vulnerability, making the attack surface broader than it may initially appear.

Remediation Measures

The extension validation logic should be executed independently of the CSRF error state. It is recommended to move the extension check and the corresponding cleanup outside of the
```
if (!isset($file->error))
```
block so that files with disallowed extensions are always removed from disk, regardless of other errors.
Rather than relying on a blacklist of dangerous extensions (e.g.,
```
.php
```
,
```
.phar
```
,
```
.phtml
```
), it is strongly recommended to implement a whitelist of permitted extensions appropriate to a documents module (e.g.,
```
.pdf
```
,
```
.docx
```
,
```
.xlsx
```
,
```
.pptx
```
,
```
.txt
```
).
CSRF token validation should either be performed before the file is written to disk, or a validation failure should result in immediate request termination rather than merely setting an error flag on the file object.

Fix

Unrestricted File Upload

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-32756

GHSA-95CQ-P4W2-32W5

Affected Products

Admidio/Admidio

CVE-2026-32756

Summary

Details

PoC

Impact

Remediation Measures

Weakness Enumeration

Related Identifiers

Affected Products

References · 3