CVE-2026-32756: 
PHP vulnerability analysis and mitigation

CVE-2026-32756 is an unrestricted file upload vulnerability (CWE-434) in the Documents & Files module of Admidio, an open-source community management platform. A design flaw in UploadHandlerFile.php allows authenticated users with upload permissions to bypass file extension restrictions by submitting an invalid CSRF token, enabling upload of arbitrary file types including PHP webshells, which can lead to Remote Code Execution (RCE). All Admidio versions up to and including 5.0.6 are affected; version 5.0.7 contains the fix. The vulnerability was published on March 15, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Admidio Advisory).

The root cause is a logic ordering flaw in src/Infrastructure/Plugins/UploadHandlerFile.php. The parent class UploadHandler::handle_file_upload() physically writes the uploaded file to disk before any Admidio-specific validation occurs. The overriding handle_file_upload() method then checks if (!isset($file->error)) before running extension validation (allowedFileExtension()) and cleanup (FileSystemUtils::deleteFileIfExists()). When CSRF validation fails in handle_form_data(), it sets $file->error and returns without terminating the request — causing the extension check block to be skipped entirely, leaving the already-written file on disk and accessible via its URL. An attacker exploits this by intentionally submitting an invalid adm_csrf_token value alongside a malicious PHP file upload to /system/file_upload.php?module=documents_files&mode=upload_files&uuid=<folder_uuid> (GitHub Advisory, Admidio Advisory).

Successful exploitation allows an authenticated attacker with upload permissions to place arbitrary server-side scripts (e.g., PHP webshells) on the web server's filesystem, achieving Remote Code Execution. This can result in full server compromise, complete loss of confidentiality (sensitive data exfiltration), integrity (arbitrary file modification), and availability (service disruption). The attack surface is broader than administrator-only scenarios — any Admidio member granted upload rights can exploit this vulnerability, and a foothold on the server enables lateral movement within the hosting environment (Admidio Advisory).

A detailed proof-of-concept with eight numbered reproduction steps is publicly available in the GitHub Security Advisory, demonstrating successful PHP webshell upload and command execution on a real Admidio deployment (Admidio Advisory). Feedly threat intelligence classifies the PoC confidence as high and confirms it is a real exploit. The EPSS score is approximately 0.085% (0.051% per GitHub Advisory), indicating low but non-zero near-term exploitation probability. No in-the-wild exploitation or threat actor attribution has been reported as of the time of writing, and the vulnerability is not currently listed in the CISA KEV catalog. Qualys has added detection for this vulnerability (detection ID 5009239) (Feedly).

1. Reconnaissance: Identify Admidio instances running version 5.0.6 or earlier using web search, Shodan, or Censys. Confirm the Documents & Files module is enabled and accessible.
2. Authenticate: Log in to the Admidio instance as any user account that has been granted upload permissions on the Documents & Files module.
3. Navigate to upload: Browse to a folder within the Documents & Files module and open the file upload dialog.
4. Intercept the request: Use a proxy tool such as Burp Suite to intercept the upload POST request sent to /system/file_upload.php?module=documents_files&mode=upload_files&uuid=<folder_uuid>.
5. Modify the CSRF token: In the intercepted request, replace the value of the adm_csrf_token field with an arbitrary invalid string (e.g., webshellgogo).
6. Substitute the payload: Replace the file being uploaded with a PHP webshell (e.g., <?php system($_GET['cmd']); ?>) saved with a .php extension.
7. Forward the request: Send the modified request. The server responds with HTTP 200 OK; the JSON body contains "error":"Invalid or missing CSRF token!", but the file has been physically written to disk.
8. Execute commands: Access the uploaded PHP file via the URL provided in the response's url field to confirm arbitrary command execution on the server (Admidio Advisory).

• Network: Unusual POST requests to /system/file_upload.php?module=documents_files&mode=upload_files&uuid=* containing an invalid or tampered adm_csrf_token value; HTTP 200 responses to these requests despite CSRF errors in the response body; outbound connections from the web server to unknown external IPs following file upload activity.
• Logs: Web server access logs showing POST requests to the file upload endpoint with subsequent GET requests to .php files in the Admidio documents/files upload directory; application logs recording "Invalid or missing CSRF token!" errors paired with successful file write events.
• File System: Unexpected .php, .phar, or .phtml files present in the Admidio documents/files upload directory (e.g., adm_my_files/ or equivalent configured path); webshell files with names like rcepoc.php or other non-document filenames.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, curl, wget, python, nc) following access to files in the upload directory (Admidio Advisory).

Upgrade Admidio to version 5.0.7 or later, which addresses this and several other security vulnerabilities; the vendor strongly recommends immediate updating (Admidio Release). If immediate upgrade is not possible, consider restricting upload permissions to the minimum necessary set of trusted users as a temporary risk reduction measure. As additional hardening, the vendor recommends implementing a whitelist of permitted file extensions (e.g., .pdf, .docx, .xlsx, .pptx, .txt) rather than a blacklist, and ensuring CSRF token validation terminates the request before any file is written to disk (Admidio Advisory).

The vulnerability was reported by a researcher credited as "arrester" and published by the Admidio maintainer "Fasse" on March 15, 2026. The release notes for v5.0.7 explicitly acknowledge that some of the addressed vulnerabilities were critical and urge all users to update immediately (Admidio Release). No significant broader media coverage or notable social media commentary beyond the advisory itself has been identified.