PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34381 Admidio CVE debrief

CVE-2026-34381 is a high-severity vulnerability in Admidio versions 5.0.0 to 5.0.7. The issue arises from Admidio's reliance on .htaccess to restrict direct HTTP access to uploaded documents. However, the Docker image is configured with 'AllowOverride None' in Apache, causing .htaccess files to be ignored. Consequently, files uploaded to the documents module can be accessed directly via HTTP without authentication, provided the file path is known. The file path is exposed in the upload response JSON. This vulnerability has been patched in version 5.0.8.

Vendor
Admidio
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Administrators and users of Admidio versions 5.0.0 through 5.0.7 should be aware of this vulnerability. Given the high severity and ease of exploitation, immediate attention is required to prevent unauthorized access to sensitive documents.

Technical summary

The vulnerability exists due to the combination of Admidio's use of .htaccess for access control and the Apache configuration in the Docker image set to 'AllowOverride None'. This configuration causes Apache to ignore .htaccess directives, effectively bypassing intended access restrictions on uploaded documents. The issue is exacerbated by the disclosure of file paths in upload response JSON, making it straightforward for attackers to access files without authentication.

Defensive priority

High

Recommended defensive actions

  • Upgrade Admidio to version 5.0.8 or later
  • Review and adjust Apache configuration to properly respect .htaccess directives
  • Implement additional access controls for documents module
  • Monitor for unauthorized access attempts
  • Restrict access to file paths disclosed in upload responses

Evidence notes

The CVE record and NVD details provide information on the vulnerability's existence and impact. The source item URL offers additional context from the NVD database. Vendor references include a patch commit and a security advisory.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T21:16:30.013Z and has not been modified since then. The NVD entry is currently Analyzed.