CVE-2026-36725
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
FastapiAdmin version v2.2.0 contains a Markdown-based XSS vulnerability in the /system/notice/create endpoint. Attackers can inject malicious JavaScript or HTML into the notice_content parameter, which will be executed in the victim's browser.
Risk Assessment
The risk involves the possibility of executing arbitrary scripts in the victim's browser, which can lead to session theft, redirects to malicious sites, or other attacks.
Recommendation
It is recommended to update FastapiAdmin to the latest version that includes a fix for this vulnerability, and to validate input data.
Other vulnerabilities in FastapiAdmin
See all- CVE-2026-36728Medium
The AI assistant chat function in FastapiAdmin v2.2.0 has a Markdown-based XSS vulnerability. Attackers can inject arbitrary scripts or HTML by sending a crafted chat message.
- CVE-2026-36724Medium
An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_task:job:update permission to cause a Denial of Service (DoS) by manipulating the func field of scheduled tasks.
Original NVD description (English source)
A markdown based cross-site scripting (XSS) vulnerability in the /system/notice/create endpoint of FastapiAdmin v2.2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the notice_content parameter.