GCVE - cpe:2.3:a:n/a:fastapiadmin:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:n/a:fastapiadmin:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	N/A (`22f567d3-1203-528c-8f0e-3eb9c2f6ca78`)
Product	Fastapiadmin (`f36f02bf-cae3-5fb6-b366-22e17295dbad`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-2979`	vulnerable	2026-06-08 07:55:17.921184	FastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted upload MEDIUM (6.3) A flaw has been found in FastApiAdmin up to 2.2.0. This issue affects the function user_avatar_upload_controller of the file /backend/app/api/v1/module_system/user/controller.py of the component Scheduled Task API. Executing a manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used. Published: 2026-02-23T08:02:07.379Z Updated: 2026-02-23T13:07:05.795Z Open on db.gcve.eu Reference links https://vuldb.com/?id.347363 https://vuldb.com/?ctiid.347363 https://vuldb.com/?submit.756156 https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2978`	vulnerable	2026-06-08 07:55:17.920705	FastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted upload MEDIUM (6.3) A vulnerability was detected in FastApiAdmin up to 2.2.0. This vulnerability affects the function upload_file_controller of the file /backend/app/api/v1/module_system/params/controller.py of the component Scheduled Task API. Performing a manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used. Published: 2026-02-23T07:32:07.978Z Updated: 2026-02-23T13:15:32.013Z Open on db.gcve.eu Reference links https://vuldb.com/?id.347362 https://vuldb.com/?ctiid.347362 https://vuldb.com/?submit.756155 https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2977`	vulnerable	2026-06-08 07:55:17.920212	FastApiAdmin Scheduled Task API controller.py upload_controller unrestricted upload MEDIUM (6.3) A security vulnerability has been detected in FastApiAdmin up to 2.2.0. This affects the function upload_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Scheduled Task API. Such manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Published: 2026-02-23T07:02:06.897Z Updated: 2026-02-23T13:18:42.686Z Open on db.gcve.eu Reference links https://vuldb.com/?id.347361 https://vuldb.com/?ctiid.347361 https://vuldb.com/?submit.756144 https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2976`	vulnerable	2026-06-08 07:55:17.919562	FastApiAdmin Download Endpoint controller.py download_controller information disclosure MEDIUM (4.3) A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function download_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Download Endpoint. This manipulation of the argument file_path causes information disclosure. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Published: 2026-02-23T06:32:07.764Z Updated: 2026-02-23T13:22:23.755Z Open on db.gcve.eu Reference links https://vuldb.com/?id.347360 https://vuldb.com/?ctiid.347360 https://vuldb.com/?submit.756089 https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2975`	vulnerable	2026-06-08 07:55:17.918569	FastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure MEDIUM (5.3) A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function reset_api_docs of the file /backend/app/plugin/init_app.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Published: 2026-02-23T06:02:07.772Z Updated: 2026-02-23T13:23:00.814Z Open on db.gcve.eu Reference links https://vuldb.com/?id.347359 https://vuldb.com/?ctiid.347359 https://vuldb.com/?submit.756067 https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-1	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.