CVE-2026-47231 Admidio CVE debrief

Who should care

Defenders responsible for Admidio installations, especially those with user upload rights to folders, should assess exposure and prioritize remediation. This includes reviewing the current installation version, restricting upload rights to trusted users and folders, and monitoring for suspicious file movements and downloads.

Why it matters

CVE-2026-47231 is a high-severity vulnerability in Admidio that allows unauthorized file access and movements, breaking confidentiality and integrity. Defenders should prioritize verifying exposure and remediating vulnerable installations.

• Private file contents may be leaked due to unauthorized file access
• File integrity may be compromised due to unauthorized file movements
• Defenders need to verify exposure and remediate vulnerable Admidio installations
• File access controls and monitoring may be necessary to prevent exploitation

Technical summary

The vulnerability exists in the `modules/documents-files.php` file of Admidio, where the `move_save` handler operates on a separate URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. This function checks the upload right on the destination folder but never on the source folder containing the file. As a result, any user who can upload to any single folder can move any file from any other folder — including private folders to which they have no view rights — into a folder they control, and then download it. Confidentiality is broken (private file contents leak) and integrity is broken (the file is removed from the original location).

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable Admidio installations, especially in environments where users have upload rights to folders.

Recommended defensive actions

• Verify Admidio installation version and exposure to vulnerable components
• Restrict upload rights to trusted users and folders
• Monitor for suspicious file movements and downloads
• Implement compensating controls, such as file access controls and monitoring
• Review relevant logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and confirmed by the vendor's security advisory. However, details about exploitation and affected versions are limited. Defenders should verify the installation version, assess exposure, and prioritize remediation. The CVE record was published on 2026-08-12T14:17:54.210Z and has not been modified since then. Limited source information is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.