CVE-2026-2976 - Vulnerability Analysis

Overview

FastApiAdmin <= 2.2.0 contains an information disclosure vulnerability caused by manipulation of the "file_path" argument in download_controller of /backend/app/api/v1/module_common/file/controller.py, letting remote attackers disclose sensitive information, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can disclose sensitive information by manipulating file_path, potentially exposing confidential data.

Mitigation

Update to the latest version beyond 2.2.0.

References

• https://vuldb.com/?submit.756089
• https://github.com/CC-T-454455/Vulnerabilities/tree/master/fastapi-admin/vulnerability-2
• https://vuldb.com/?ctiid.347360
• https://vuldb.com/?id.347360

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner