Admidio up to 5.0.9 Move documents-files.php File::moveToFolder folder_uuid/file_uuid unrestricted upload

Summaryinfo

A vulnerability identified as critical has been detected in Admidio up to 5.0.9. The affected element is the function File::moveToFolder of the file modules/documents-files.php of the component Move. This manipulation of the argument folder_uuid/file_uuid causes unrestricted upload. The identification of this vulnerability is CVE-2026-47231. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical was found in Admidio up to 5.0.9. Affected by this vulnerability is the function File::moveToFolder of the file modules/documents-files.php of the component Move. The manipulation of the argument folder_uuid/file_uuid with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on the destination folder but never on the source folder containing the file. As a result, any user who can upload to any single folder can move any file from any other folder — including private folders to which they have no view rights — into a folder they control, and then download it. Confidentiality is broken (private file contents leak) and integrity is broken (the file is removed from the original location). Version 5.0.10 contains a fix.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-47231 since 05/19/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

By approaching the search of inurl:modules/documents-files.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.0.10 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Admidio

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9

Website

• Product: https://github.com/Admidio/admidio/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion