CVE-2026-36725: XSS
A markdown based cross-site scripting (XSS) vulnerability in the /system/notice/create endpoint of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the noticecontent parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the notice creation feature is not required, disable the /system/notice/create endpoint or otherwise disable notice-creation functionality to prevent submission of crafted payloads to the notice_content parameter.
FastapiAdmin (/system/notice/create) endpoint_enabled = false - Compensating control
Restrict access to the /system/notice/create endpoint to trusted/internal IP addresses and/or place the endpoint behind a WAF or input-filtering proxy to block requests containing script or HTML content in the notice_content parameter.
- Operational
Review existing stored notices for malicious HTML or script in notice_content, sanitize or remove any suspicious entries to mitigate stored XSS, and clear any caches or rendered outputs that might contain the injected content.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates no prior privileges are required and the attack can be delivered over the network. Exploitation does require user interaction, meaning someone must view or otherwise render the crafted notice content.
Which component and input should be investigated?
Review the /system/notice/create endpoint in FastapiAdmin v2.2.0, specifically handling of the notice_content parameter. Crafted Markdown content may inject script or HTML that executes when rendered.
What is the likely impact if exploitation succeeds?
The issue can cause script execution in a user's browser and has low confidentiality and integrity impact in the CVSS assessment. The scope is changed, indicating the vulnerable component can affect another security authority, such as the browser context of a user viewing the content.