{"id":"CVE-2026-88396","published":"2026-10-05T16:17:17.080","lastModified":"2026-10-06T23:16:56.530","description":"ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.","cvssScore":7.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/ApiAdmin/rce.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/fangtang7/CVE/blob/main/ApiAdmin/rce.md","tags":[]}],"hasPoc":true,"ai":null}