Executive brief
admin3 is a lightweight backend management framework written in Java/Spring Boot. The application's file upload feature fails to properly validate filenames, allowing authenticated users to write files to locations outside the intended storage directory on Windows systems. An attacker with valid credentials can exploit this to overwrite arbitrary files accessible to the server process, potentially leading to application compromise or data destruction.
Technical details
The vulnerability is a path traversal flaw in the upload handler where client-supplied filenames are concatenated directly into the storage key without sanitization. The StorageServiceImpl generates a 5-character random prefix followed by the unsanitized filename; when this is resolved against the storage root using LocalStorage.store(), no containment check is performed. On Windows, attackers can use multiple dot-dot (..) path segments to escape the configured storage directory and reach parent directories. The 5-character prefix fuses with the first "..", requiring N+1 ".." groups to traverse N levels above the storage root. Exploitation requires valid authentication and is limited to Windows deployments; Linux systems fail due to per-component path resolution. An authenticated attacker can overwrite files with arbitrary content accessible to the server process, including application files or configuration.
Affected products
- admin3 admin3 through 3.0.0
Timeline
- 2026-09-17: disclosed
- other: CVE-2026-92919 assigned