admin3 vulnerabilities

2 known vulnerabilities in admin3 from Cjbi. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  admin3: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-92919Sep 17, 2026Cjbi

  admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured s

• 8.8 High severity

  admin3: Insertion of Sensitive Information into Log File

  CVE-2026-92918Sep 17, 2026Cjbi

  admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bea