CVE-2026-32756 identifies a critical unrestricted file upload vulnerability in Admidio versions 5.0.6 and below. An authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token, allowing the upload of arbitrary file types. This design flaw carries a CVSS score of 8.8 (High) and can lead to Remote Code Execution, resulting in full server compromise, data exfiltration, and lateral movement. Currently, there is no public exploit code available, nor any indication of active exploitation, community discussion, or media coverage regarding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.0.7CPE matchmatch criteria | cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.