CVE-2026-2977: FastApiAdmin Scheduled Task API controller.py upload_controller unrestricted upload
A security vulnerability has been detected in FastApiAdmin up to 2.2.0. This affects the function uploadcontroller of the file /backend/app/api/v1/modulecommon/file/controller.py of the component Scheduled Task API. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2977?
CVE-2026-2977 is rated as a medium severity vulnerability due to the risk of unauthorized file uploads.
How do I fix CVE-2026-2977?
To fix CVE-2026-2977, update FastApiAdmin to version 2.2.1 or later where the vulnerability has been addressed.
What are the consequences of CVE-2026-2977?
The consequences of CVE-2026-2977 include the potential for malicious users to upload arbitrary files to the server.
Which versions of FastApiAdmin are affected by CVE-2026-2977?
CVE-2026-2977 affects all versions of FastApiAdmin up to and including 2.2.0.
Does CVE-2026-2977 affect other components apart from the Scheduled Task API?
CVE-2026-2977 specifically targets the Scheduled Task API and does not affect other components directly.