CVE-2026-2978
Published: 23 February 2026
Summary
CVE-2026-2978 is a medium-severity Improper Access Control (CWE-284) vulnerability in Fastapiadmin Fastapiadmin. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-2978 is a vulnerability in FastApiAdmin versions up to 2.2.0 that enables unrestricted file upload. It affects the upload_file_controller function located in the file /backend/app/api/v1/module_system/params/controller.py within the Scheduled Task API component. The issue, associated with CWEs-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type), was published on 2026-02-23 and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
An attacker can exploit this vulnerability remotely by performing a manipulation on the affected endpoint. Exploitation requires low privileges (PR:L), low attack complexity, and no user interaction, allowing network-accessible initiation. Successful attacks result in low-level impacts to confidentiality, integrity, and availability, stemming from the unrestricted upload capability.
References including VulDB entries (vuldb.com/?ctiid.347362, vuldb.com/?id.347362, vuldb.com/?submit.756155) and a GitHub repository (github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-4) detail the issue, with the latter hosting a public exploit that may be used. Security practitioners should review these advisories for any recommended mitigations or patches.
The exploit is publicly available, increasing the risk of active exploitation in affected environments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7610
Vulnerability details
A vulnerability was detected in FastApiAdmin up to 2.2.0. This vulnerability affects the function upload_file_controller of the file /backend/app/api/v1/module_system/params/controller.py of the component Scheduled Task API. Performing a manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit…
more
is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) in public-facing FastAPI admin endpoint directly enables T1190 exploitation; facilitates T1105 tool/file ingress and T1505.003 web shell deployment via malicious uploads.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of uploaded files to reject dangerous types before they are accepted by upload_file_controller.
Enforces access-control policy on the Scheduled Task API endpoint so that only authorized file operations are permitted.
Limits privileges of the low-privileged accounts that can reach the vulnerable upload function, reducing the attack surface.