The FastApiAdmin backend contains a flaw in the upload_file_controller function of its Scheduled Task API. A remote attacker who can reach the upload endpoint can submit any file, bypassing both file‑type validation and authorization checks. Because the stored files are written directly to the server’s filesystem, the upload allows the attacker to place arbitrary files on the system, presenting opportunities for further exploitation. This unrestricted upload capability could be leveraged in various attack scenarios, though the CVE description does not confirm that uploaded files can be executed.

FastApiAdmin versions up to and including 2.2.0 are affected. The vulnerability resides in the file located at backend/app/api/v1/module_system/params/controller.py and is present in all releases prior to 2.2.1. Any deployment of FastApiAdmin that has not been upgraded beyond 2.2.0 remains vulnerable.

The CVSS score of 5.3 categorizes the weakness as medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog, but publicly available exploit code exists, suggesting that attackers who target exposed instances could deploy the vulnerability. The likely attack vector is a remote HTTP POST request to the upload endpoint, requiring no local privileges and enabling attackers to inject files into the system.