CVE-2026-2976 - Vulnerability Details

- FastApiAdmin Download Endpoint controller.py download_controller information disclosure

Description

A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function download_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Download Endpoint. This manipulation of the argument file_path causes information disclosure. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

Published: 2026-02-23

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the download_controller of the Download Endpoint. An attacker can manipulate the file_path argument to access arbitrary files on the server, resulting in the disclosure of sensitive information. The flaw falls under Information Exposure, Improper Access Control, and Unrestricted Upload weaknesses.

Affected Systems

The affected product is FastApiAdmin, versions up to and including 2.2.0. No specific patch version is listed, but the issue is present in all releases up to 2.2.0.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low current exploitation probability in the wild. The vulnerability is not listed in the KEV catalog. However, because the attack vector is remote and an exploit is publicly available, the potential impact is significant. An attacker only needs to send a crafted request to the download endpoint to read protected files.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

FastApiAdmin

affected

Version	Status	Constraints
`2.0`	affected	—
`2.1`	affected	—
`2.2.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:fastapiadmin:fastapiadmin:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Fastapiadmin

100%

Version	Status	Scheme	Platform
`[2.0,2.0]`	affected	generic	—
`[2.1,2.1]`	affected	generic	—
`2.2.0`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade FastApiAdmin to a version later than 2.2.0 where the file_path validation flaw has been fixed.
Ensure that the download endpoint enforces proper authentication and authorization checks before allowing file access.
Add input validation to restrict file_path to allowed directories and file types, rejecting any inputs that attempt directory traversal or request disallowed file extensions.

Generated by OpenCVE AI on April 17, 2026 at 16:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00039.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-2
https://vuldb.com/?ctiid.347360
https://vuldb.com/?id.347360
https://vuldb.com/?submit.756089

History

Thu, 05 Mar 2026 13:15:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:fastapiadmin:fastapi-admin:2.0:::::::* cpe:2.3:a:fastapiadmin:fastapi-admin:2.1:::::::* cpe:2.3:a:fastapiadmin:fastapi-admin:2.2.0:::::::*	cpe:2.3:a:fastapiadmin:fastapiadmin::::::::
Vendors & Products	Fastapiadmin fastapi-admin

Tue, 24 Feb 2026 16:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fastapiadmin fastapi-admin
Weaknesses		CWE-434
CPEs		cpe:2.3:a:fastapiadmin:fastapi-admin:2.0:::::::* cpe:2.3:a:fastapiadmin:fastapi-admin:2.1:::::::* cpe:2.3:a:fastapiadmin:fastapi-admin:2.2.0:::::::*
Vendors & Products		Fastapiadmin fastapi-admin

Mon, 23 Feb 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fastapiadmin Fastapiadmin fastapiadmin
Vendors & Products		Fastapiadmin Fastapiadmin fastapiadmin

Mon, 23 Feb 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 23 Feb 2026 07:00:00 +0000

Type	Values Removed	Values Added
Description		A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function download_controller of the file /backend/app/api/v1/module_common/file/controller.py of the component Download Endpoint. This manipulation of the argument file_path causes information disclosure. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Title		FastApiAdmin Download Endpoint controller.py download_controller information disclosure
Weaknesses		CWE-200 CWE-284
References		https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-2 https://vuldb.com/?ctiid.347360 https://vuldb.com/?id.347360 https://vuldb.com/?submit.756089
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Fastapiadmin Fastapiadmin

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-02-23T06:32:07.764Z

Updated: 2026-02-23T13:22:23.755Z

Reserved: 2026-02-22T15:09:05.206Z

Link: CVE-2026-2976

Vulnrichment

Updated: 2026-02-23T13:22:17.537Z

NVD

Status : Analyzed

Published: 2026-02-23T07:16:22.680

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-2976

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-17T16:30:05Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object