Path Traversal in admin3 Upload Handler

CVE-2026-92919 describes a path traversal vulnerability in the admin3 application (all versions up to and including 3.0.0). The vulnerability resides in the file upload handler, which fails to adequately sanitize client-supplied filenames. When deployed on Windows systems, an authenticated user can provide filenames containing path traversal sequences, such as dot-dot (../ or ..), to break out of the designated storage root. This allows the attacker to write or overwrite files anywhere on the filesystem accessible to the user account running the admin3 process. If the attacker can write to executable directories or configuration files, this could lead to remote code execution or full system compromise. Defenders should prioritize auditing web server access logs for anomalous file upload requests containing path traversal characters and update to a patched version if available.

Impact

Successful exploitation allows authenticated attackers to perform arbitrary file writes on the host system. This can lead to system-wide compromise, data loss, or the deployment of malicious binaries if the attacker can target sensitive application or system directories.

Recommendation

• Identify all instances of admin3 running on Windows servers within the environment.
• Review web application logs for POST requests to the file upload endpoint containing path traversal sequences (e.g., "../", "..\").
• Restrict access to the file upload functionality to trusted, authenticated users only.
• Monitor for unauthorized file creation or modification events in sensitive system directories, such as startup folders or application config paths, using EDR or file integrity monitoring.