CVE-2026-88396
UnknownSummary
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim with no whitelist, blacklist or content check, and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.
Risk Assessment
The risk is critical because it allows remote code execution on the server by a logged-in administrator, which could lead to full system compromise. However, it requires an administrator account.
Recommendation
It is recommended to immediately upgrade ApiAdmin and implement file extension validation and content checking. Also restrict administrator privileges and monitor uploaded files.
Other vulnerabilities in ApiAdmin
See all- CVE-2026-88397Unknown
ApiAdmin v5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
- CVE-2026-71622High
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component.
- CVE-2026-71620High
File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file.
Original NVD description (English source)
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS