The vulnerability allows an attacker to include an arbitrary server file by providing a ‘name’ parameter containing path traversal characters (../) to the add mode in modules/documents-files.php. Because the parameter is only validated as a generic string and no CSRF token is required, an attacker can trick a documents administrator into clicking a crafted link that registers a server file such as install/config.php into a documents folder that is subsequently accessible to the attacker. This results in expression of sensitive configuration data, including database credentials, over the web. The weakness is a classic Path Traversal flaw (CWE‑22).

All Admidio installations running a version prior to 5.0.9 are vulnerable; the issue was fixed starting with version 5.0.9.

The CVSS score of 4.5 indicates a moderate severity. The EPSS score is not publicly available and the vulnerability is not listed in CISA KEV. Exploitation requires a social‑engineering step to get a privileged administrator to click a malicious link, and the attack relies on the lack of CSRF protection and SameSite=Lax cookie policy. Overall, the risk is moderate with a relatively low likelihood of widespread exploitation.