CVE-2026-2978 in FastApiAdmin
Summary
by MITRE • 02/23/2026
A vulnerability was detected in FastApiAdmin up to 2.2.0. This vulnerability affects the function upload_file_controller of the file /backend/app/api/v1/module_system/params/controller.py of the component Scheduled Task API. Performing a manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/27/2026
This vulnerability resides within the FastApiAdmin framework version 2.2.0 and specifically targets the upload_file_controller function located in the Scheduled Task API component at /backend/app/api/v1/module_system/params/controller.py. The flaw represents a critical unrestricted file upload vulnerability that allows remote attackers to bypass security controls and upload arbitrary files to the server. The vulnerability stems from inadequate input validation and sanitization mechanisms within the file upload functionality, enabling malicious actors to execute potentially harmful operations through the compromised upload endpoint.
The technical implementation of this vulnerability demonstrates a classic security misconfiguration where the application fails to properly validate file types, extensions, or content before processing uploads. This weakness creates an attack surface that aligns with CWE-434, which specifically addresses the insecure upload of code or files. The remote exploitability of this vulnerability means that attackers can initiate the malicious upload process without requiring physical access to the system or local network presence, making it particularly dangerous for web applications. The public availability of exploit code further amplifies the risk, as it reduces the barrier to successful exploitation.
From an operational impact perspective, this vulnerability could enable attackers to upload malicious scripts, executables, or payload files that could compromise the entire application server. The unrestricted nature of the upload allows for potential execution of arbitrary code, which could lead to complete system compromise, data exfiltration, or establishment of persistent backdoors. The affected Scheduled Task API component suggests that the vulnerability could be leveraged to manipulate automated processes, potentially creating opportunities for privilege escalation or lateral movement within the network infrastructure. This type of vulnerability directly violates fundamental security principles and could result in significant business disruption and regulatory compliance violations.
Organizations should immediately implement mitigations including input validation, file type restriction, and content scanning for all file upload endpoints. The recommended approach involves implementing strict file extension validation, using secure random naming for uploaded files, and ensuring proper file content verification through multiple layers of checks. Additionally, access controls should be enforced to limit upload capabilities to authorized users only. The vulnerability's classification as a remote exploit with public availability necessitates immediate patching or workaround implementation, as outlined in the mitre ATT&CK framework's techniques for file and directory manipulation. Security teams should also monitor for suspicious upload activities and implement network segmentation to limit potential damage from successful exploitation attempts.