CVE-2026-86244 in FastAdmin
Summary
by MITRE • 09/07/2026
A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in FastAdmin versions up to 1.2.0.20210401_beta represents a significant security risk within the User Controller module, specifically targeting the register and login functionality located in application/index/controller/User.php. This flaw is categorized as an input validation error where the url argument passed during user registration or authentication processes fails to undergo proper sanitization before being rendered back into the client-side context. The core technical deficiency lies in the insufficient filtering of special characters within this parameter, allowing attackers to inject malicious script payloads directly into the application's response stream. Because the vulnerable code path is accessible over a network connection, this vulnerability can be exploited remotely by an unauthenticated attacker without requiring prior access credentials or complex authentication bypasses.
From a classification perspective, this issue aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting (XSS). The specific nature of this vulnerability suggests it is likely an Reflected XSS attack vector, where the malicious input is immediately returned to the user in a response. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit falls under T1059 which covers Command and Scripting Interpreter techniques, specifically leveraging browser-based scripting environments like JavaScript or HTML scripts to execute arbitrary code within the victim's context. The public disclosure of the exploit indicates that proof-of-concept code is available in the wild, significantly lowering the barrier for entry for opportunistic attackers seeking to compromise instances running these older versions.
The operational impact of a successful exploitation can be severe and multifaceted. An attacker who successfully injects malicious scripts into the url parameter can execute arbitrary JavaScript in the context of the victim's browser session. This capability enables several detrimental outcomes including session hijacking through theft of authentication cookies, credential harvesting by presenting fake login forms that mimic legitimate pages, defacement of the user interface to damage organizational reputation, and potentially redirecting users to malicious phishing sites or malware distribution networks. Since FastAdmin is often used for building administrative backends and business applications, compromising these sessions can lead to unauthorized access to sensitive data, modification of critical configurations, or further lateral movement within an organization's network infrastructure if the compromised session holds elevated privileges.
To mitigate this risk, immediate action is required by upgrading the affected component to version 1.2.1.20210731_beta or later. The patch associated with commit hash b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b addresses the root cause by implementing robust input validation and output encoding mechanisms for the url argument within the User controller. Organizations should verify their deployment environments to ensure no instances of vulnerable versions remain in production or staging areas. In addition to upgrading, it is advisable to implement Web Application Firewall rules that detect common XSS payload patterns targeting login and registration endpoints as a temporary compensating control while migration efforts are underway. Regular security audits and code reviews focusing on input handling in web frameworks will help prevent similar vulnerabilities from being introduced in future development cycles.