A flaw in FastApiAdmin up to version 2.2.0 allows an attacker to upload arbitrary files through the user_avatar_upload_controller in the Scheduled Task API module without authentication or file type validation. The vulnerability is a classic unrestricted file upload, mapping to CWE‑434, and combined with improper access control (CWE‑284), it can lead to the execution of uploaded code or other malicious payloads. According to the CVE description, the flaw can be exploited remotely, and an off‑the‑shelf exploit has been published and may be used.

This vulnerability affects the FastApiAdmin application released by FastApiAdmin. All instances running any version up to and including 2.2.0 are impacted; no other versions are known to be affected.

The CVSS score is 5.3, reflecting a medium severity with potential for moderate impact. The EPSS score is below 1%, indicating a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can remotely target the exposed API endpoint, upload a malicious file, and then trigger its execution through the application or by accessing the file via a publicly accessible URL. Proper mitigations, however, can effectively eliminate the risk.