The vulnerability resides in FastApiAdmin's upload_controller function within the Scheduled Task API component. The code accepts file uploads without authenticating the caller or validating the file type, exposing the application to arbitrary file uploads. This flaw aligns with missing access control (CWE‑284) and unchecked file handling (CWE‑434). Based on the description, it is inferred that an attacker can consequently place malicious binaries or scripts on the server, potentially allowing further exploitation if the application later serves or executes those files.

All installations of FastApiAdmin version 2.2.0 or earlier that include the backend/app/api/v1/module_common/file/controller.py module of the Scheduled Task API are affected. Users running these versions should review whether the upload_controller endpoint remains exposed in their environment.

The CVSS base score of 5.3 indicates medium risk, while an EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The vulnerability is publicly disclosed and can be triggered remotely through the upload endpoint, as stated in the description. Although the flaw is not listed in CISA's KEV catalog, the possibility of bulk uploads of arbitrary files poses a significant integrity threat if the application serves or processes those files.