CVE-2026-2976

CVE-2026-2976 affects FastApiAdmin up to 2.2.0. The vulnerability resides in the Download Endpoint, specifically the download_controller in /backend/app/api/v1/module_common/file/controller.py, where manipulation of the file_path argument leads to information disclosure. The issue can be triggere...

CVE-2026-2975

A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function resetapidocs of the file /backend/app/plugin/initapp.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed...

CVE-2026-2975 FastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure

A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function resetapidocs of the file /backend/app/plugin/initapp.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed...

CVE-2026-2975 FastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure

A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function resetapidocs of the file /backend/app/plugin/initapp.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed...

PT-2026-21504

Name of the Vulnerable Software and Affected Versions FastApiAdmin versions up to 2.2.0 Description A flaw exists in FastApiAdmin that allows for unrestricted file uploads. This issue impacts the upload file controller function located in the file /backend/app/api/v1/module...

CVE-2026-2979: Unrestricted Upload of File with Dangerous Type

A flaw has been found in FastApiAdmin up to 2.2.0. This issue affects the function useravataruploadcontroller of the file /backend/app/api/v1/modulesystem/user/controller.py of the component Scheduled Task API. Executing a manipulation can lead to unrestricted upload. The attack can be launched...

CVE-2026-2978: Unrestricted Upload of File with Dangerous Type

A vulnerability was detected in FastApiAdmin up to 2.2.0. This vulnerability affects the function uploadfilecontroller of the file /backend/app/api/v1/modulesystem/params/controller.py of the component Scheduled Task API. Performing a manipulation results in unrestricted upload. The attack can be...

CVE-2026-2977: Unrestricted Upload of File with Dangerous Type

A security vulnerability has been detected in FastApiAdmin up to 2.2.0. This affects the function uploadcontroller of the file /backend/app/api/v1/modulecommon/file/controller.py of the component Scheduled Task API. Such manipulation leads to unrestricted upload. It is possible to launch the atta...

CVE-2026-2976: Exposure of Sensitive Information to an Unauthorized Actor

A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function downloadcontroller of the file /backend/app/api/v1/modulecommon/file/controller.py of the component Download Endpoint. This manipulation of the argument filepath causes information disclosure. It is...

CVE-2026-2975: Exposure of Sensitive Information to an Unauthorized Actor

A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function resetapidocs of the file /backend/app/plugin/initapp.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed...

PT-2026-21501

Name of the Vulnerable Software and Affected Versions FastApiAdmin versions prior to 2.3 Description A weakness exists in FastApiAdmin that allows information disclosure. This is due to the manipulation of the file path argument within the download controller function located in the file...

PT-2026-21506

Name of the Vulnerable Software and Affected Versions FastApiAdmin versions up to 2.2.0 Description A flaw exists in FastApiAdmin that allows for unrestricted file upload. This issue is located within the user avatar upload controller function in the file /backend/app/api/v1/module...

PT-2026-21500

Name of the Vulnerable Software and Affected Versions FastApiAdmin versions through 2.2.0 Description A security flaw exists in FastApiAdmin up to version 2.2.0. The reset api docs function within the Custom Documentation Endpoint component, located in the file /backend/app/plugin/init app.py, is...