Admidio versions 5.0.6 and earlier contain an unrestricted file upload flaw in the Documents & Files module. A design mistake in CSRF token validation and file extension checking allows an authenticated user with upload permissions to bypass the restriction by submitting an invalid token. The attacker can upload arbitrary files, including PHP scripts, which, if executed, can lead to remote code execution, full server compromise, data exfiltration, and lateral movement.

This vulnerability affects the Admidio open‑source user management solution, specifically the Documents & Files module. Any installation running version 5.0.6 or earlier is susceptible. The product is identified as Admidio:admidio in the Common Platform Enumeration.

With a CVSS score of 8.8, the flaw is considered high severity. The EPSS score is below 1 %, suggesting a low current probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the flaw requires only an authenticated user with upload rights and a deliberate CSRF token trick to be exploited, which could result in arbitrary code execution on the host.