CVE-2026-92919: admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
admin3to a version that resolves this vulnerability.Fixed in 3.0.0 - Configuration
Update the upload handler’s filename sanitization so that dot-dot path segments in uploaded filenames cannot escape the configured storage root.
admin3 upload handler filename sanitization = sanitize client-supplied filenames to prevent dot-dot (.. ) path traversal from escaping the configured storage directory
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated admin3 account with access to the upload handler. Exploitation is limited to Windows deployments.
What level of access does an attacker gain through the file write?
The attacker can overwrite files outside the configured storage directory, but only files that are accessible to the server process. Successful exploitation can affect integrity and availability.
How can I determine whether a deployment is exposed?
A deployment is exposed if it runs admin3 through version 3.0.0 on Windows and permits authenticated users to upload files through the affected upload handler. Review upload activity for filenames containing dot-dot path segments, which are used to escape the storage directory.