提交 #756155: fastapiadmin <= 2.2.0 Unrestricted Upload

An unrestricted file upload vulnerability in FastapiAdmin (≤ 2.2.0) at /api/v1/system/param/upload allows authenticated users with the module_system:param:upload permission to write arbitrary files to the server filesystem and, when combined with the scheduled task APIs, achieve remote code execution; the upload routine trusts the Content-Type header to infer allowed extensions, does not validate or canonicalize file paths, and writes files directly under the upload directory, enabling attackers to bypass extension checks (e.g., upload a Python script disguised as an SVG), persist it, and trigger execution via task scheduling. Mitigations include enforcing server-side content inspection (validate file magic bytes), deriving extensions from content not headers, normalizing and restricting saved paths to a safe upload directory with no execute permissions, generating safe randomized filenames, imposing strict allowlists for upload types, scanning uploads for dangerous content, and requiring least-privilege access controls and audit logging for upload and task APIs.

• 来源: ⚠️ https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-4
• 用户: Anonymous User
• 提交: 2026-02-11 09時58分 (3 月前)
• 管理: 2026-02-22 16時09分 (11 days later)
• 状态: 已接受
• VulDB条目: 347362 [FastApiAdmin 直到 2.2.0 Scheduled Task API controller.py upload_file_controller 权限提升]
• 积分: 20