CVE-2026-2976 - FastApiAdmin Download Endpoint controller.py download_controller information disclosure

Back Back to CVE browser

MEDIUM

FastApiAdmin Download Endpoint controller.py download_controller information disclosure

Published Feb 23, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.50%

Description

A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function download_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Download Endpoint. This manipulation of the argument file_path causes information disclosure. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

Affected products

Vendor n/a Product FastApiAdmin Default
n/a
- Version
  2.0
  Status
  affected
  Constraints
  -
- Version
  2.1
  Status
  affected
  Constraints
  -
- Version
  2.2.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

FastApiAdmin

n/a

Version	Status	Constraints
2.0	affected	-
2.1	affected	-
2.2.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-200

Exposure of Sensitive Information

CWE-284

CWE-434

Unrestricted Upload of File

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-7608
Advisory
https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-2
exploitThird Party Advisory
https://vuldb.com/?ctiid.347360
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.347360
vdb-entrytechnical-descriptionThird Party Advisory
https://vuldb.com/?submit.756089
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-7608		Advisory
https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-2		exploitThird Party Advisory
https://vuldb.com/?ctiid.347360		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.347360		vdb-entrytechnical-descriptionThird Party Advisory
https://vuldb.com/?submit.756089		third-party-advisoryThird Party Advisory