Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution on the server, resulting in full server compromise, data exfiltration, and lateral movement. This issue has been fixed in version 5.0.7.

Affected: Packagist: admidio/admidio

### **Summary**

A critical unrestricted file upload vulnerability exists in the Documents & Files module of Admidio. Due to a design flaw in how CSRF token validation and file extension verification interact within `UploadHandlerFile.php`, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution (RCE) on the server.

### **Details**

**1. Critical - Unrestricted File Upload leading to Remote Code Execution (RCE)**

**Root Cause Analysis:**

The root cause lies in a design flaw in `src/Infrastructure/Plugins/UploadHandlerFile.php`. The `UploadHandlerFile` class overrides two methods from its parent `UploadHandler` class:

- `handle_form_data($file, $index)` — Validates the CSRF token. On failure, it sets `$file->error` and returns. The request is **not** terminated. - `handle_file_upload(...)` — Calls `parent::handle_file_upload()` to physically write the file to disk, then checks `if (!isset($file->error))` before running file extension validation (`allowedFileExtension()`).

The execution flow differs based on whether the CSRF token is valid:

- **Valid CSRF token**: `handle_form_data()` does not set an error → extension check runs → invalid extension causes the uploaded file to be deleted from disk. - **Invalid CSRF token**: `handle_form_data()` sets `$file->error` → the `if (!isset($f…