| 제목 | fastapiadmin <= 2.2.0 Unrestricted Upload |
|---|
| 설명 | An unrestricted file upload vulnerability in FastapiAdmin (≤ 2.2.0) at /api/v1/system/user/current/avatar/upload allows authenticated users to write arbitrary files to the server filesystem and, when combined with the scheduled task APIs, achieve remote code execution; the upload routine trusts the Content-Type header to infer allowed extensions, does not validate or canonicalize file paths, and writes files directly under the upload directory, enabling attackers to bypass extension checks (e.g., upload a Python script disguised as an SVG), persist it, and trigger execution via task scheduling. Mitigations include enforcing server-side content inspection (validate file magic bytes), deriving extensions from content not headers, normalizing and restricting saved paths to a safe upload directory with no execute permissions, generating safe randomized filenames, imposing strict allowlists for upload types, scanning uploads for dangerous content, and requiring least-privilege access controls and audit logging for upload and task APIs. |
|---|
| 원천 | ⚠️ https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-5 |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 02. 11. AM 09:59 (6 개월 ago) |
|---|
| 모더레이션 | 2026. 02. 22. PM 04:09 (11 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 347363 [FastApiAdmin 까지 2.2.0 Scheduled Task API controller.py user_avatar_upload_controller 권한 상승] |
|---|
| 포인트들 | 20 |
|---|