admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2026-92919
Publishedadmin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-92919 · CVE overview and exploitation status
cve-program · CVE-2026-92919
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C03_storage_path_traversal_write.py
- https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/storage/LocalStorage.java
- https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetech/admin3/infra/storage/StorageServiceImpl.java
- https://github.com/cjbi/admin3
- https://www.vulncheck.com/advisories/admin3-through-3.0.0-arbitrary-file-write-via-path-traversal-in-storage-upload-filename
This historical advisory does not include today's related changes. Open the latest advisory to find current connections.