CVE-2026-88396

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-06

Assigner: MITRE

Description

ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-88396

EUVD

EUVD-2026-92468

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is an Arbitrary File Upload Remote Code Execution (RCE) flaw in ApiAdmin version 5.0 and earlier. The vulnerability exists in the admin file-upload endpoint POST /admin/Index/upload. Any logged-in admin user can upload a PHP file without validation for extension, content, or path. The file is saved directly into a web-accessible directory with its original extension, allowing attackers to execute arbitrary PHP code by accessing the file via HTTP.

Detection Guidance

Check for unauthorized PHP files in the public/upload/Ymd/ directory. Use commands like 'find /var/www/public/upload/ -name "*.php"' to locate suspicious files. Monitor HTTP POST requests to /admin/Index/upload with PHP file extensions.

Impact Analysis

An attacker with admin access can upload a malicious PHP file, such as a webshell, to the server. This allows them to execute arbitrary commands on the server, potentially leading to full system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected ApiAdmin versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade ApiAdmin to a patched version if available. Implement strict file upload validation to block PHP files. Restrict write permissions to the public/upload/ directory. Review logs for unauthorized uploads and remove any suspicious files.

Hi! I’m here to help you understand CVE-2026-88396. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70