CVE-2026-2978: FastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted upload
A vulnerability was detected in FastApiAdmin up to 2.2.0. This vulnerability affects the function uploadfilecontroller of the file /backend/app/api/v1/modulesystem/params/controller.py of the component Scheduled Task API. Performing a manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2978?
CVE-2026-2978 is considered a high severity vulnerability due to its potential for unrestricted file uploads.
How do I fix CVE-2026-2978?
To address CVE-2026-2978, upgrade FastApiAdmin to a version higher than 2.2.0 to ensure the upload_file_controller function is secure.
What systems are affected by CVE-2026-2978?
CVE-2026-2978 affects all versions of FastApiAdmin up to and including 2.2.0.
What type of attack is possible with CVE-2026-2978?
CVE-2026-2978 allows attackers to exploit unrestricted file uploads, potentially leading to arbitrary code execution.
Was CVE-2026-2978 publicly disclosed?
Yes, CVE-2026-2978 was publicly disclosed in relation to FastApiAdmin vulnerability reports.