CVE-2026-2977

Name of the Vulnerable Software and Affected Versions FastApiAdmin versions up to 2.2.0

Description A security issue has been identified in FastApiAdmin. The upload controller function within the file /backend/app/api/v1/module common/file/controller.py of the Scheduled Task API allows for unrestricted file uploads. This manipulation can be initiated remotely. The exploit for this issue has been publicly disclosed.

Recommendations Versions prior to 2.2.0 are recommended. As a temporary workaround, consider restricting access to the upload controller function until a patch is available.