CVE-2026-92919: Cjbi ADMIN3

High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days.

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.

Affected products

• Cjbi ADMIN3: up to and including 3.0.0

Published 2026-09-17. Last modified 2026-09-22.