CVE-2026-88396

ApiAdmin versions v5.0 and before are vulnerable to Directory Traversal via the POST /admin/Index/upload endpoint. The application fails to perform whitelist, blacklist, or content checks on uploaded file extensions, allowing the move_uploaded_file() function to drop files into the web-accessible...

EUVD-2026-92468

ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and moveuploadedfile drops the file into the web-accessible directory...