What is the CVSS score of CVE-2026-51775?

CVE-2026-51775 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of FastAdmin are affected by CVE-2026-51775?

FastAdmin v1.6.1.20250430 contains a critical remote code execution vulnerability via SQL injection in the Backend.php component that could enable complete system compromise.

How to fix or mitigate CVE-2026-51775?

Within 24 hours: Immediately inventory all systems running FastAdmin v1.6.1.20250430 and determine which handle production data or connect to sensitive networks; isolate any critical instances from internet-facing access using network segmentation or firewall rules. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection payloads targeting the Backend.php component; enable detailed logging on all FastAdmin instances to detect exploitation attempts; apply any available configuration hardening or input validation patches from the vendor. Within 30 days: Contact the vendor for patch timeline and migration options; evaluate alternative administrative tools if patches remain unavailable; plan and execute migration away from FastAdmin v1.6.1 for all production systems, prioritizing those with internet exposure.

FastAdmin CVE-2026-51775

EUVD-2026-52480 CRITICAL

SQL Injection (CWE-89)

2026-08-03 mitre

GHSA-gv5j-v9wc-3wcw

PHP RCE SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network SQLi with low complexity and no user interaction, but the vulnerable Backend.php admin controller typically requires an authenticated session, so PR:L rather than PR:N; full CIA impact from total DB compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:40 vuln.today

CVSS changed

Aug 06, 2026 - 22:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 03, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component

AnalysisAI

SQL injection in FastAdmin v1.6.1.20250430 lets remote attackers inject arbitrary SQL through the application/common/controller/Backend.php component, with the vendor advisory characterizing the impact as extending to arbitrary code execution. The flaw is tagged RCE/SQLi/PHP and carries a CVSS 9.8 rating with total technical impact per CISA's SSVC framework, though publicly available exploit code exists rather than confirmed active exploitation. EPSS is low (0.14%, 4th percentile), suggesting exploitation is not yet widespread despite the critical severity.

Technical ContextAI

FastAdmin is a PHP-based rapid-development backend admin framework built on the ThinkPHP ecosystem, widely used in Chinese-language web application projects to scaffold administrative interfaces. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaches a SQL query without adequate sanitization or parameterization. The affected component is application/common/controller/Backend.php, the base backend controller from which admin CRUD controllers inherit - so a flaw here can propagate broadly across the admin surface. In PHP frameworks, such injection typically arises when request parameters (filters, sort fields, or query conditions) are concatenated into query builder calls instead of bound as parameters. CPE data is not meaningfully populated (cpe:2.3:a:n/a:n/a) so exact product identification relies on the description and vendor advisory.

RemediationAI

No vendor-released patched version is identified in the available data, so a specific upgrade target cannot be cited; monitor the FastAdmin project and the advisory at https://gitee.com/Tor443/security-advisory/blob/master/README.md for a fixed release. As compensating controls, restrict network access to the FastAdmin backend/admin routes to trusted management IP ranges via firewall or reverse-proxy allowlisting (trade-off: legitimate remote admins must use a VPN/jump host), and place a WAF rule in front of the application to detect and block SQL metacharacters in parameters reaching Backend.php-derived endpoints (trade-off: pattern-based rules can be bypassed and may cause false positives on legitimate admin input). Enforce strong authentication and least-privilege on all admin accounts, and enable database query logging plus a low-privilege DB account for the app to limit the blast radius of a successful injection. Review and parameterize any custom controllers extending Backend.php. Track the fix under CVE-2026-51775 / EUVD-2026-52480.