CVE-2026-88396: ApiAdmin ApiAdmin vulnerability
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and moveuploadedfile() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated as an ApiAdmin administrator. The vulnerable upload endpoint is POST /admin/Index/upload, so unauthenticated users are not described as able to exploit it.
What conditions are required for successful code execution?
The attacker needs to upload a PHP file through the admin upload endpoint and then access the uploaded file over HTTP. Uploaded files are placed in the web-accessible public/upload/Ymd/ directory.
Are default upload restrictions sufficient to prevent exploitation?
No upload restrictions are described for the affected endpoint: it accepts the supplied extension verbatim and has no extension whitelist, blacklist, or content validation. This permits an authenticated administrator to upload a .php file.
How can I check whether an instance may be affected?
Check whether the deployment runs ApiAdmin v5.0 or earlier and exposes POST /admin/Index/upload to logged-in administrators. Review the public/upload/ date-based directories for unexpected PHP files that may be directly reachable over HTTP.