PT-2026-21500

Name of the Vulnerable Software and Affected Versions FastApiAdmin versions through 2.2.0 Description A security flaw exists in FastApiAdmin up to version 2.2.0. The reset api docs function within the Custom Documentation Endpoint component, located in the file /backend/app/plugin/init app.py, is...

PT-2026-21504

Name of the Vulnerable Software and Affected Versions FastApiAdmin versions up to 2.2.0 Description A flaw exists in FastApiAdmin that allows for unrestricted file uploads. This issue impacts the upload file controller function located in the file /backend/app/api/v1/module...

CVE-2026-2978: Unrestricted Upload of File with Dangerous Type

A vulnerability was detected in FastApiAdmin up to 2.2.0. This vulnerability affects the function uploadfilecontroller of the file /backend/app/api/v1/modulesystem/params/controller.py of the component Scheduled Task API. Performing a manipulation results in unrestricted upload. The attack can be...

PT-2026-21501

Name of the Vulnerable Software and Affected Versions FastApiAdmin versions prior to 2.3 Description A weakness exists in FastApiAdmin that allows information disclosure. This is due to the manipulation of the file path argument within the download controller function located in the file...

CVE-2026-2977: Unrestricted Upload of File with Dangerous Type

A security vulnerability has been detected in FastApiAdmin up to 2.2.0. This affects the function uploadcontroller of the file /backend/app/api/v1/modulecommon/file/controller.py of the component Scheduled Task API. Such manipulation leads to unrestricted upload. It is possible to launch the atta...

CVE-2026-2976: Exposure of Sensitive Information to an Unauthorized Actor

A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function downloadcontroller of the file /backend/app/api/v1/modulecommon/file/controller.py of the component Download Endpoint. This manipulation of the argument filepath causes information disclosure. It is...

CVE-2026-2975: Exposure of Sensitive Information to an Unauthorized Actor

A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function resetapidocs of the file /backend/app/plugin/initapp.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed...