Vulnerability record · CVE-2021-32630 · published 20 May 2021

CVE-2021-32630: Admidio unrestricted file upload vulnerability

Admidio · Admidio

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.0.4, there is an authenticated RCE via .phar file upload. A php web shell can be uploaded via the Documents & Files upload feature. Someone with upload permissions could rename the php shell with a .phar extension, visit the file, triggering the payload for a reverse/bind shell. This can be mitigated by excluding a .phar file extension to be uploaded (like you did with .php .phtml .php5 etc). The vulnerability is patched in version 4.0.4.

8.8 CVSS 3.1 High EPSS 1.6% · top 25.3% CWE-434 · Unrestricted file upload

8.8CVSS 3.1 base score, v2 6.5

1.6%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Admidio Admidio

References

Link	Tags
https://github.com/Admidio/admidio/issues/994	Third Party Advisory
https://github.com/Admidio/admidio/releases/tag/v4.0.4	Release NotesThird Party Advisory
https://github.com/Admidio/admidio/security/advisories/GHSA-xpqj-67r8-25j2	ExploitThird Party Advisory
https://github.com/Admidio/admidio/issues/994	Third Party Advisory
https://github.com/Admidio/admidio/releases/tag/v4.0.4	Release NotesThird Party Advisory
https://github.com/Admidio/admidio/security/advisories/GHSA-xpqj-67r8-25j2	ExploitThird Party Advisory

Track CVE-2021-32630 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-32817Admidio missing authorization vulnerabilityAdmidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the curre…EPSS 0.48%20 Mar 2026 8.8CVE-2026-32756Admidio unrestricted file upload vulnerabilityAdmidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documen…EPSS 0.95%20 Mar 2026 8.8CVE-2024-37906Admidio sql injection vulnerabilityAdmidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Inje…EPSS 0.93%29 Jul 2024 8.8CVE-2024-38529Admidio unrestricted file upload vulnerabilityAdmidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote C…EPSS 1.2%29 Jul 2024 8.0CVE-2026-32813Admidio sql injection vulnerabilityAdmidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configurati…EPSS 0.42%20 Mar 2026 7.8CVE-2023-3302Admidio csv injection vulnerabilityImproper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.EPSS 0.46%23 Jun 2023 7.5CVE-2026-34381Admidio improper access control vulnerabilityAdmidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny dire…EPSS 0.52%31 Mar 2026 7.5CVE-2020-11004Admidio sql injection vulnerabilitySQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validatio…EPSS 1.5%24 Apr 2020

Source: NIST National Vulnerability Database (record CVE-2021-32630), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.