CVE-2026-2976: FastApiAdmin Download Endpoint controller.py download_controller information disclosure
A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function downloadcontroller of the file /backend/app/api/v1/modulecommon/file/controller.py of the component Download Endpoint. This manipulation of the argument filepath causes information disclosure. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2976?
CVE-2026-2976 is classified as a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2026-2976?
To remediate CVE-2026-2976, upgrade FastApiAdmin to version 2.3.0 or later.
What type of vulnerability is CVE-2026-2976?
CVE-2026-2976 is an information disclosure vulnerability affecting the download_controller function.
Which versions of FastApiAdmin are affected by CVE-2026-2976?
FastApiAdmin versions up to and including 2.2.0 are affected by CVE-2026-2976.
Where can I find more information about CVE-2026-2976?
Additional details about CVE-2026-2976 can be found in security advisories and vulnerability databases.