PT-2026-139184

CVE-2026-121491

Published

2026-11-07

Updated

2026-11-11

Description by

CVSS 3.1

9.0

Critical

MetricsAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fiber Admin versions 3.1.0 through 4.0.0

Description An issue exists where a request header is not validated or escaped before being written into a regenerated PHP file on an unprotected admin hook. This allows unauthenticated attackers to execute arbitrary code if the custom database error page is enabled and the attacker wins a race condition against an administrator saving settings.

Recommendations Update Fiber Admin to version 4.0.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Naoki Kawahigashi

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers