CVE-2026-2978: Fastapi-admin RCE Vulnerability

CVE-2026-2978 Overview

A vulnerability was detected in FastApiAdmin up to version 2.2.0. This vulnerability affects the function upload_file_controller of the file /backend/app/api/v1/module_system/params/controller.py of the component Scheduled Task API. Performing a manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used.

Critical Impact

Remote attackers can exploit the unrestricted file upload vulnerability to upload arbitrary files to the server, potentially leading to remote code execution, data compromise, or system takeover.

Affected Products

• FastApiAdmin fastapi-admin version 2.0
• FastApiAdmin fastapi-admin version 2.1
• FastApiAdmin fastapi-admin version 2.2.0

Discovery Timeline

• 2026-02-23 - CVE CVE-2026-2978 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-2978

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control), indicating a failure in the application's access control mechanisms within the file upload functionality. The vulnerable component resides in the Scheduled Task API, specifically within the upload_file_controller function located at /backend/app/api/v1/module_system/params/controller.py.

The unrestricted file upload flaw allows authenticated users to upload files without proper validation of file types, extensions, or content. This design oversight bypasses security controls that should restrict what types of files can be uploaded to the server. When exploited, attackers can upload malicious files such as web shells, executable scripts, or other payloads that can be subsequently executed on the target system.

Root Cause

The root cause of this vulnerability is improper access control (CWE-284) in the file upload handler. The upload_file_controller function fails to implement adequate file validation checks, including:

• Missing file type validation based on content (MIME type verification)
• Absent file extension whitelisting or blacklisting
• Lack of file size restrictions
• No sanitization of uploaded file names

This allows attackers with low-level privileges to bypass intended restrictions and upload arbitrary files to the server's file system.

Attack Vector

The attack can be initiated remotely over the network. An authenticated attacker with low privileges can send specially crafted HTTP requests to the Scheduled Task API endpoint. The exploitation flow typically involves:

1. Authenticating to the FastApiAdmin application with a low-privileged account
2. Crafting a malicious file upload request targeting the vulnerable endpoint
3. Uploading a malicious file (e.g., web shell, reverse shell script)
4. Accessing or triggering the uploaded malicious file to execute arbitrary code

For detailed technical information about this vulnerability, refer to the GitHub Vulnerability Repository or the VulDB entry #347362.

Detection Methods for CVE-2026-2978

Indicators of Compromise

• Unexpected files appearing in upload directories with suspicious extensions (e.g., .py, .php, .sh, .exe)
• Unusual HTTP POST requests to /backend/app/api/v1/module_system/params/controller.py containing file upload data
• Newly created files with web shell signatures or reverse shell patterns in the file content
• Anomalous outbound network connections originating from the web server process

Detection Strategies

• Monitor file system changes in upload directories for unauthorized file types or suspicious file names
• Implement web application firewall (WAF) rules to detect and block malicious file upload attempts
• Review access logs for unusual patterns of requests to the Scheduled Task API endpoint
• Deploy endpoint detection and response (EDR) solutions to detect post-exploitation activities

Monitoring Recommendations

• Enable detailed logging for all file upload operations in the FastApiAdmin application
• Configure alerts for file creation events in web-accessible directories with executable permissions
• Implement integrity monitoring on critical application directories
• Establish baseline behavior patterns for the Scheduled Task API to identify anomalous usage

How to Mitigate CVE-2026-2978

Immediate Actions Required

• Restrict access to the Scheduled Task API to only trusted administrators
• Implement network-level access controls to limit exposure of the vulnerable endpoint
• Review and audit all recently uploaded files for malicious content
• Disable the file upload functionality if not required for business operations
• Monitor for any signs of exploitation in your environment

Patch Information

At the time of publication, no vendor patch has been officially announced for this vulnerability. Organizations using FastApiAdmin versions 2.0, 2.1, and 2.2.0 should monitor the official FastApiAdmin repository and security advisories for patch releases. Until a patch is available, implement the recommended workarounds below to reduce risk.

For additional information and updates, refer to the VulDB CTI entry.

Workarounds

• Implement server-side file validation to check file extensions, MIME types, and file content before accepting uploads
• Configure a whitelist of allowed file extensions and reject all others
• Store uploaded files outside the web root directory to prevent direct execution
• Rename uploaded files to random strings to prevent predictable file access
• Implement proper access control checks to restrict who can use the file upload functionality

# Example: Restrict access to upload endpoint via nginx
location /backend/app/api/v1/module_system/params/controller.py {
    # Allow only specific trusted IPs
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    
    # Add additional security headers
    add_header X-Content-Type-Options "nosniff" always;
}