CVE-2026-71620

ApiAdmin 5.0.1, an open-source PHP API management/admin platform distributed via GitHub by 'Zhao-github', contains an unrestricted file upload flaw (CWE-434) reachable over the network by an attacker holding a low-privileged account. The attacker uploads a crafted .php file that bypasses file-type validation and lands in a web-accessible directory, then requests that file to execute arbitrary attacker-controlled PHP code on the server. Successful exploitation yields code execution with high impact on confidentiality and integrity of the application and its data (CVSS 3.1 base score 8.1; availability impact is rated none), but it does not grant unauthenticated access. Only version 5.0.1 is identified in the advisory, so deployments running that release are the ones to check. No public proof of concept exists, the CVE is not in CISA's KEV catalog, and EPSS currently estimates only about a 0.2% probability of exploitation within 30 days, so there is no evidence of in-the-wild abuse.

What to do: Move any ApiAdmin 5.0.1 deployment off that version and track the project's official repository for a patched release, since no fixed version is specified in the advisory. As interim mitigations, enforce a strict file-extension whitelist on uploads, configure the web server (e.g., Apache/nginx) to deny PHP execution inside upload directories, and restrict which users hold accounts on the admin panel. Review upload directories and access logs for unexpected .php files or requests to them, which would indicate attempted or successful exploitation.