CVE-2026-88396: v5.0 Remote Code Execution (RCE) - PoC Available

Thehackerwire • October 5, 2026

ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.

Official Advisories & References

CVE-2026-88396 Proof of Concept (PoC) & Exploits

Verified Exploit Advisories & Links

Community & Discussion

Critical Vulnerabilities — Last 7 Days

Real-time tracking of CVSS 9.0+ remote execution zero-days, public exploit code, and ransomware-linked vulnerabilities disclosed this week.

Frequently Asked Questions

CVE-2026-88396 is a Info severity security vulnerability. ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is...

To protect against CVE-2026-88396, you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

This vulnerability was publicly disclosed on October 5, 2026. Organizations should check if they were vulnerable during the period before the patch was available.

Yes, public proof-of-concept (PoC) exploit references and code are available for CVE-2026-88396. Security teams should test and verify mitigation controls on affected assets immediately.

Currently, CVE-2026-88396 is not recorded in the CISA Known Exploited Vulnerabilities (KEV) catalog as being actively exploited in the wild. Security teams should still patch proactively to prevent zero-day targeting.

⚡ Security Analysis & Testing Tools

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-88396: RCE Vulnerability in ApiAdmin v5.0 Disclosed On October 5, 2026, CVE-2026-88396 was disclosed, affecting ApiAdmin v5.0 and earlier versions. The vulnerability allows any logged-in admin user to upload a PHP file through the unprotected file-upload endpoint, enabling remote code execution (RCE) on the server. The flaw arises from a lack of validation on the file extension, allowing attackers to execute arbitrary PHP code. Although a proof-of-concept (PoC) exploit is publicly available, there are currently no reports of in the wild. Organizations using affected versions are advised to apply security patches immediately to mitigate the risk. The vulnerability has a CVSS score of 9.0, indicating a severity level. Security teams should monitor their systems for any signs of exploitation and ensure that they have updated to the latest version of the software. 1 sources 70

Extracted Entities

CVE-2026-88396: v5.0 Remote Code Execution (RCE) - PoC Available

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Vulnerabilities (1)