CVE-2026-88396 in ApiAdmin
Summary
by MITRE • 10/05/2026
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in ApiAdmin versions 5.0 and earlier represents a critical failure in input validation and access control mechanisms within the administrative interface. Specifically, the flaw resides in the POST /admin/Index/upload endpoint, which is designed to handle file uploads for system administration purposes. The core technical deficiency lies in the application's handling of user-supplied filenames during the upload process. Instead of implementing robust sanitization procedures such as whitelisting allowed extensions or validating content types against MIME signatures, the software accepts the uploaded file's extension verbatim from the client request. This lack of validation allows an attacker to bypass standard security controls by simply appending a server-side executable extension, such as .php, to their malicious payload.
The operational impact of this flaw is severe, leading directly to Remote Code Execution on the target server. Because the application utilizes PHP's move_uploaded_file function without additional checks, it places the uploaded file into the web-accessible directory public/upload/Ymd/, where Ymd represents a date-based subdirectory structure generated by the system. Since there are no restrictions preventing executable scripts from being stored in this publicly reachable path, an authenticated administrator user can upload a PHP shell or any other malicious script. Once uploaded, these files become immediately accessible via HTTP requests at predictable URLs constructed using the public/upload directory and the provided filename. This allows attackers to execute arbitrary commands with the privileges of the web server process, potentially leading to full system compromise, data exfiltration, lateral movement within the network, or defacement of the application interface.
From a classification perspective, this vulnerability aligns closely with CWE-434, which describes the Unrestricted Upload of File with Dangerous Type. The failure to verify that uploaded files contain only expected content types constitutes a classic instance of unrestricted file upload. Furthermore, because exploitation requires an authenticated admin user account, it also relates to CWE-269, Improper Privilege Control, as the attacker leverages valid credentials to access functionality intended for trusted users but fails due to insufficient input validation within that privileged context. In terms of attack vectors and tactics, this scenario maps to MITRE ATT&CK technique T1505.003, Server Side Web Shell, where attackers deploy web shells on compromised servers to maintain persistent access and execute commands remotely.
Mitigation strategies must address both the immediate technical flaw and broader security posture improvements. The most critical remediation step is to implement strict file extension whitelisting that only permits non-executable formats such as images or documents relevant to the application's function, while explicitly blocking extensions like .php, .jsp, .asp, and others associated with server-side execution. Additionally, developers should enforce content-type validation by inspecting the actual binary signature of the uploaded file rather than relying solely on the Content-Type header sent by the client, which can be easily spoofed. It is also advisable to store uploaded files outside the web root or in a directory that does not have execute permissions enabled for the web server process. Implementing randomization of filenames upon upload further complicates an attacker's ability to locate and invoke their malicious scripts. Finally, ensuring that administrative interfaces are protected by multi-factor authentication and IP whitelisting can reduce the risk of credential theft leading to exploitation of this vulnerability.