CVE-2026-92919
HighCVSS 8.1Summary
The admin3 application through version 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.
Risk Assessment
An authenticated attacker can overwrite arbitrary files accessible to the server process, potentially leading to remote code execution or full system compromise. The risk is particularly high in Windows environments.
Recommendation
Update the admin3 application to a version newer than 3.0.0. Implement validation and sanitization of user-supplied filenames and restrict server process privileges.
Other vulnerabilities in admin3
See all- CVE-2026-92921Medium
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort.
- CVE-2026-92920Medium
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.
- CVE-2026-92918High
The admin3 application through version 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.
Original NVD description (English source)
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.