PatchTheCVECVE-2026-2895: A security flaw has been discovered in funadmin up to 7.1.0-rc4
CVE-2026-2895 is a low-severity flaw (CVSS 3.7) affecting funadmin. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used fo
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.7 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 61%) |
| CISA exploited list | No |
| Weakness | CWE-640 |
| Published | 2026-02-21 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-2895?
funadmin: upgrade to 7.1.0. Exact commands for each OS are on this page.
Is CVE-2026-2895 being exploited?
CVE-2026-2895 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-2895 affect?
CVE-2026-2895 affects funadmin. Severity is low (CVSS 3.7). A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak pas
How urgent is CVE-2026-2895?
Priority 33/100. Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-2898 MEDIUM 5.5 UPGRADE A vulnerability was detected in funadmin up to 7.1.0-rc4
- CVE-2026-2897 LOW 2.4 UPGRADE A security vulnerability has been detected in funadmin up to 7.1.0-rc4
- CVE-2026-2896 HIGH 7.3 UPGRADE A weakness has been identified in funadmin up to 7.1.0-rc4
- CVE-2026-2894 MEDIUM 5.3 UPGRADE A vulnerability was identified in funadmin up to 7.1.0-rc4
- CVE-2024-48231 HIGH 7.2 DOWNGRADE Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\c