CVE-2026-47231

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.10

Description An issue exists in the modules/documents-files.php file where state-changing operations are gated by checking the hasUploadRight() function on the folder uuid URL parameter. However, the move save handler operates on a separate file uuid parameter and calls the File::moveToFolder($destFolderUUID) function, which only verifies upload rights for the destination folder and fails to check the source folder containing the file. Consequently, any user with upload permissions for at least one folder can move any file from any other folder—including private folders they cannot view—into a folder they control to download it. This results in a breach of confidentiality through the leak of private file contents and a breach of integrity as files are removed from their original locations.

Recommendations Update Admidio to version 5.0.10. As a temporary mitigation, restrict the folder upload right to only trusted users to minimize the risk of unauthorized file movement.