ApiAdmin CVE-2026-88396

Requires an authenticated admin session on the ApiAdmin panel - the POST /admin/Index/upload endpoint is reachable only by a logged-in admin user, which is the primary limiting factor (matches PR:H). Given that admin access, no further special conditions apply: the upload handler performs NO extension whitelist, blacklist, or content-type/content inspection, and files land in the web-accessible public/upload/Ymd/ directory under default behavior, so a .php payload is directly executable. Limiting factors beyond authentication: the public/upload path must be served and PHP-executable by the web server (typical default), and exploitation depends on holding or obtaining admin credentials rather than any unauthenticated vector.

This is a genuine but access-gated remote code execution flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH) is internally consistent with the description: network-reachable endpoint, low complexity, no user interaction, but requiring high privileges (PR:H) because exploitation is limited to an already-authenticated admin user. This privilege requirement is the single most important risk-dampening signal and reconciles the full C:H/I:H/A:H RCE impact with the moderate 7.2 score. Exploitation signals are mixed-to-low: EPSS is only 0.35% (26th percentile), indicating low predicted near-term mass exploitation, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. However, a public write-up with exploitation details (fangtang7/CVE rce.md) means publicly available exploit code exists, so the technical barrier is trivial once admin access is held. No SSVC decision data was provided. Net: this is a credible post-authentication admin-to-RCE escalation, not an unauthenticated internet-wide emergency - treat it as a real priority only where untrusted or lower-trust users hold admin panel access, where the admin credential is weak/shared, or as a chained post-compromise step, rather than as a mass-exploitation threat.

An attacker who has obtained ApiAdmin admin-panel credentials (via phishing, credential reuse, or a lower-privileged admin account) logs in and POSTs a .php webshell to /admin/Index/upload, which performs no extension whitelist, blacklist, or content validation. move_uploaded_file() writes the file under the web-accessible public/upload/Ymd/ directory, and the attacker requests it directly over HTTP to execute arbitrary PHP and gain code execution on the server. A public proof-of-concept write-up documenting this exact path exists.