Is CVE-2026-34381 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34381 being exploited in the wild.

How severe is CVE-2026-34381?

High severity, with a CVSS score of 7.5, published 31 March 2026.

Which products and versions are affected?

Admidio >= 5.0.0, < 5.0.8; admidio/admidio (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.0.8.

Is there a fix for CVE-2026-34381?

Yes. admidio/admidio (Packagist): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34381 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34381?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34381: Admidio improper access control in Docker image document storage

Q: Which products and versions are affected?

Admidio >= 5.0.0, < 5.0.8; admidio/admidio (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.0.8.

Q: Is there a fix for CVE-2026-34381?

Yes. admidio/admidio (Packagist): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34381 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-34381?

Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34381 · Severity: high · CVSS 7.5 · Published 2026-03-31

Admidio is an open-source platform used by organizations to manage member data and documents. A security flaw in its Docker-based installation allows unauthorized users to bypass access controls and download sensitive files, such as contracts or financial records, without logging in. This occurs because the system's web server is configured to ignore the security rules intended to protect the document storage folder. An attacker who knows or can guess a file's web address can access it directly, potentially leading to a significant data breach.

Technologies: Admidio, admidio/admidio (Packagist). Vendors: Admidio, Packagist.

Quick answers

Is CVE-2026-34381 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34381 being exploited in the wild.
How severe is CVE-2026-34381?: High severity, with a CVSS score of 7.5, published 31 March 2026.
Which products and versions are affected?: Admidio >= 5.0.0, < 5.0.8; admidio/admidio (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.0.8.
Is there a fix for CVE-2026-34381?: Yes. admidio/admidio (Packagist): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34381 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34381?: Check whether you run Admidio or admidio/admidio (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

admidio/admidio (Packagist): upgrade to 5.0.8 or later
```
composer require admidio/admidio:^5.0.8
```

Technical details

Admidio versions 5.0.0 through 5.0.7 rely on .htaccess files within the 'adm_my_files' directory to restrict direct HTTP access to uploaded documents. However, the official Docker image ships with an Apache configuration set to 'AllowOverride None', which causes the web server to ignore these .htaccess security directives. Consequently, any file uploaded to the documents module is served directly by Apache without performing the application's role-based access control (RBAC) checks. An unauthenticated attacker can retrieve any file if they know the path, which is also leaked in the JSON response during the upload process. The issue is resolved in version 5.0.8 by enabling 'AllowOverride All' for the specific upload directory.

Affected products

Admidio Admidio >= 5.0.0, < 5.0.8

Identifiers

CVE-2026-34381
GHSA-7fh7-8xqm-3g88

Timeline

2026-03-27: advisory: GitHub Security Advisory published
2026-03-31: disclosed: CVE-2026-34381 published to NVD
2026-03-31: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.