CVE-2026-2977
Published: 23 February 2026
Summary
CVE-2026-2977 is a medium-severity Improper Access Control (CWE-284) vulnerability in Fastapiadmin Fastapiadmin. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-2977 is a security vulnerability in FastApiAdmin versions up to 2.2.0 that enables unrestricted file upload. It affects the upload_controller function located in the file /backend/app/api/v1/module_common/file/controller.py within the Scheduled Task API component. Published on 2026-02-23, the issue carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is linked to CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
The vulnerability is exploitable remotely by an attacker with low privileges, requiring low complexity and no user interaction. Manipulation of the affected upload_controller function allows unrestricted upload, potentially leading to low-level impacts on confidentiality, integrity, and availability.
Advisories and details on the vulnerability, including potential mitigation steps, are available from VulDB at https://vuldb.com/?ctiid.347361, https://vuldb.com/?id.347361, and https://vuldb.com/?submit.756144, as well as a GitHub repository at https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-3. The exploit has been publicly disclosed and may be used in attacks.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7609
Vulnerability details
A security vulnerability has been detected in FastApiAdmin up to 2.2.0. This affects the function upload_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Scheduled Task API. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely.…
more
The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) in public-facing FastAPI web app directly enables initial access via T1190; facilitates arbitrary file ingress (T1105) and web shell deployment (T1505.003) for execution/persistence.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces access restrictions on the upload_controller function to block unrestricted file uploads by unauthorized or low-privilege users.
Requires validation of all input files (type, content, extension) to the Scheduled Task API upload path, directly mitigating CWE-434.
Limits privileges assigned to the upload_controller so that only explicitly authorized accounts can perform file uploads.