Executive brief
django-vue-admin is a web application framework that combines Django and Vue.js. A vulnerability in the file upload endpoint allows attackers to bypass access controls by manipulating the file_id parameter, potentially exposing or modifying files they should not have permission to access.
Technical details
The vulnerability is an improper access control flaw in the /api/file/ endpoint of django-vue-admin version 1.0. By manipulating the file_id parameter, an attacker can bypass authorization checks and gain unauthorized access to files. The vulnerability is remotely exploitable without requiring authentication and does not necessitate user interaction. An attacker can read or manipulate files they do not have permission to access. Public exploits are available, though the vendor has not released a patch and has not responded to early disclosure attempts.
Affected products
- caoqianming django-vue-admin 1.0
Timeline
- 2026-08-31: disclosed: Public disclosure via CVE-2026-82835