CVE-2026-2978 | FastApiAdmin up to 2.2.0 Scheduled Task API controller.py upload_file_controller unrestricted upload

A vulnerability was found in FastApiAdmin up to 2.2.0. It has been rated as critical. This vulnerability affects the function upload_file_controller of the file /backend/app/api/v1/module_system/params/controller.py of the component Scheduled Task API. Performing a manipulation results in unrestricted upload.

This vulnerability is identified as CVE-2026-2978. The attack can be initiated remotely. Additionally, an exploit exists.