Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
Date: 2026-05
Affected: composer/admidio/admidio
Attack vector: data-exfiltration
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-47231
CWE: CWE-639
CWE-863
CVSS: 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

## Summary `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on the **destination** folder but never on the **source** folder containing the file. As a result, any user who can upload to any single folder can move any file from any other folder — including private folders to which they have no view rights — into a folder they control, and then download it. Confidentiality is broken (private file contents leak) and integrity is broken (the file is removed from the original location). ## Details ### Vulnerable Code `modules/documents-files.php:79-89` — top-level rights check binds to URL `folder_uuid`: ```php if ($getMode != 'list' && $getMode != 'download') { // check the rights of the current folder // user must be administrator or must have the right to upload files $folder = new Folder($gDb); $folder->getFolderForDownload($getFolderUUID); if (!$folder->hasUploadRight()) { $gMessage->show($gL10n->get('SYS_NO_RIGHTS')); // => EXIT } } ``` `modules/documents-files.php:187-204` — the `move_save` branch loads the file by UUID without revalidating the file's actual parent folder: ```php case 'move_save': $documentsFilesMoveForm = $gCurrentSession->getFormObject($_P


Mitigations:

Architectural layers (MAESTRO):