PT-2026-21503 · Unknown · Fastapi-Admin
CVE-2026-2977
·
Publicado
2026-02-23
·
Atualizado
2026-03-05
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FastApiAdmin versions up to 2.2.0
Description
A security issue has been identified in FastApiAdmin. The
upload controller function within the file /backend/app/api/v1/module common/file/controller.py of the Scheduled Task API allows for unrestricted file uploads. This manipulation can be initiated remotely. The exploit for this issue has been publicly disclosed.Recommendations
Versions prior to 2.2.0 are recommended. As a temporary workaround, consider restricting access to the
upload controller function until a patch is available.Exploit
Correção
Improper Access Control
Unrestricted File Upload
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Fastapi-Admin