The vulnerability is an IDOR in the Admidio documents module that allows any user with upload permissions to move files from any folder, including private ones, into a folder they control. The move operation validates the target folder but neglects to verify the source folder’s rights, enabling unauthorized file exfiltration and deletion from the original location. This results in confidentiality loss of private file contents and integrity compromise as files are extracted from their intended storage.

Affected systems include any installations of Admidio before version 5.0.10, where the modules/documents-files.php script handles move operations without checking source folder access. The patch is included in release 5.0.10, so systems currently running an earlier release are vulnerable.

The CVSS score of 8.1 indicates high severity, and the EPSS score is not provided, so the likelihood of exploitation remains uncertain. The vulnerability is not yet listed in the CISA KEV catalog. An attacker can exploit this via a standard web request to the move_save mode, with only the upload privilege as a prerequisite. The absence of a source‑folder check means the attack can be carried out by any user with upload rights, making it broadly exploitable across installations.