CVE-2026-2979: FastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted upload
A flaw has been found in FastApiAdmin up to 2.2.0. This issue affects the function useravataruploadcontroller of the file /backend/app/api/v1/modulesystem/user/controller.py of the component Scheduled Task API. Executing a manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2979?
CVE-2026-2979 has been classified with a high severity due to the potential for unauthorized file uploads.
How do I fix CVE-2026-2979?
To fix CVE-2026-2979, update FastApiAdmin to version 2.2.1 or later where the vulnerability has been addressed.
Which versions of FastApiAdmin are affected by CVE-2026-2979?
CVE-2026-2979 affects all versions of FastApiAdmin up to and including 2.2.0.
What type of vulnerability is CVE-2026-2979?
CVE-2026-2979 is an unrestricted upload vulnerability that can allow malicious users to upload arbitrary files.
What components are impacted by CVE-2026-2979?
CVE-2026-2979 impacts the user_avatar_upload_controller function within the FastApiAdmin Scheduled Task API.