CVE-2026-2979
Published: 23 February 2026
Summary
CVE-2026-2979 is a medium-severity Improper Access Control (CWE-284) vulnerability in Fastapiadmin Fastapiadmin. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-2979 is a vulnerability in FastApiAdmin versions up to 2.2.0 that enables unrestricted file upload. The flaw affects the user_avatar_upload_controller function in the file /backend/app/api/v1/module_system/user/controller.py within the Scheduled Task API component. Published on 2026-02-23, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is linked to CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
A remote attacker with low privileges (PR:L) can exploit this issue with low attack complexity and no user interaction. Exploitation allows manipulation leading to impacts on confidentiality, integrity, and availability, albeit at a low level per the CVSS metrics.
Advisories referenced in VulDB entries (https://vuldb.com/?ctiid.347363, https://vuldb.com/?id.347363, https://vuldb.com/?submit.756156) document the vulnerability details. A GitHub repository at https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-5 contains a published exploit that may be used.
The published exploit highlights the risk of real-world exploitation in affected FastApiAdmin deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7611
Vulnerability details
A flaw has been found in FastApiAdmin up to 2.2.0. This issue affects the function user_avatar_upload_controller of the file /backend/app/api/v1/module_system/user/controller.py of the component Scheduled Task API. Executing a manipulation can lead to unrestricted upload. The attack can be launched remotely.…
more
The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload (CWE-434) in a network-accessible web admin component directly enables initial access via exploitation of a public-facing app (T1190) and deployment of web shells for execution (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces access control policy on the user_avatar_upload_controller so that only explicitly authorized subjects may perform file uploads, directly blocking the improper access path exploited by CVE-2026-2979.
Requires validation of all input to the Scheduled Task API upload function, rejecting files whose type or content violates the allowed set and thereby closing the unrestricted-upload flaw (CWE-434).
Limits the privileges assigned to the upload controller and its callers so that low-privileged remote users cannot reach or abuse the avatar upload path described in the CVE.