CVE-2026-2977: Fastapi-admin RCE Vulnerability

CVE-2026-2977 Overview

A security vulnerability has been detected in FastApiAdmin up to version 2.2.0. This affects the function upload_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Scheduled Task API. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Critical Impact

Unrestricted file upload vulnerability allowing remote attackers to upload arbitrary files to the server, potentially leading to remote code execution, data compromise, or system takeover.

Affected Products

• FastApiAdmin 2.0
• FastApiAdmin 2.1
• FastApiAdmin 2.2.0

Discovery Timeline

• 2026-02-23 - CVE CVE-2026-2977 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-2977

Vulnerability Analysis

This vulnerability is classified as an unrestricted file upload flaw (CWE-284: Improper Access Control). The affected component is the upload_controller function within the Scheduled Task API module. The vulnerability allows attackers with low-privilege access to upload arbitrary files to the server without proper validation or restrictions.

The network-accessible nature of this vulnerability means that any authenticated user with minimal privileges can remotely exploit the flaw. The impact affects confidentiality, integrity, and availability of the system, though each at a limited scope. Successfully exploiting this vulnerability could enable attackers to upload malicious scripts, web shells, or other executable content that may lead to further compromise of the underlying system.

Root Cause

The root cause of this vulnerability lies in the improper access control implementation within the file upload functionality. The upload_controller function located at /backend/app/api/v1/module_common/file/controller.py fails to implement adequate restrictions on:

1. File type validation - allowing upload of potentially dangerous file types
2. File content verification - not validating file contents against declared MIME types
3. Access control enforcement - insufficient authorization checks for the upload operation

Attack Vector

The attack is conducted over the network and requires low-privilege authentication to the FastApiAdmin application. An attacker can exploit this vulnerability by sending crafted HTTP requests to the Scheduled Task API endpoint with malicious file payloads.

The vulnerability manifests in the upload_controller function where file uploads are processed without proper validation. Attackers can leverage this weakness to upload arbitrary files including web shells or malicious scripts. For detailed technical analysis, refer to the GitHub Vulnerability Repository.

Detection Methods for CVE-2026-2977

Indicators of Compromise

• Unexpected files appearing in upload directories or web-accessible folders
• Unusual file extensions being uploaded (e.g., .py, .sh, .php, .jsp)
• Suspicious HTTP POST requests to /api/v1/module_common/file/ endpoints
• Web shell activity or reverse shell connections originating from the server

Detection Strategies

• Monitor web server logs for POST requests to the file upload API endpoint with unusual file types or large payloads
• Implement file integrity monitoring on upload directories to detect unauthorized file additions
• Deploy web application firewall (WAF) rules to inspect and block requests containing malicious file upload patterns
• Review access logs for authenticated users making repeated upload requests to the Scheduled Task API

Monitoring Recommendations

• Enable detailed logging for all file upload operations including source IP, user context, and file metadata
• Configure alerting for file uploads containing executable content or script extensions
• Implement real-time monitoring of the /backend/app/api/v1/module_common/file/ endpoint activity
• Track authentication events correlated with file upload attempts to identify compromised accounts

How to Mitigate CVE-2026-2977

Immediate Actions Required

• Restrict access to the Scheduled Task API file upload functionality to only trusted administrative users
• Implement file type whitelisting to allow only explicitly permitted file extensions
• Add server-side file content validation to verify uploaded files match expected MIME types
• Consider temporarily disabling the file upload feature if not critical to operations

Patch Information

At the time of publication, no official vendor patch has been released for this vulnerability. Organizations using FastApiAdmin versions 2.0, 2.1, or 2.2.0 should monitor the official project repository for security updates. Additional technical details are available through the VulDB CTI entry.

Workarounds

• Implement a reverse proxy or WAF rule to filter upload requests to the vulnerable endpoint
• Apply file extension validation at the web server level (e.g., nginx or Apache configuration)
• Configure upload directories with non-executable permissions to prevent uploaded script execution
• Restrict network access to the administrative API endpoints using firewall rules

# Example nginx configuration to restrict file upload types
location /api/v1/module_common/file/ {
    # Restrict access to trusted IPs only
    allow 10.0.0.0/8;
    deny all;
    
    # Limit upload size
    client_max_body_size 10M;
    
    # Additional security headers
    add_header X-Content-Type-Options "nosniff" always;
}