CVE-2026-36725 describes a markdown-based cross-site scripting (XSS) vulnerability in FastapiAdmin version 2.2.0. The issue exists in the /system/notice/create endpoint where the notice_content parameter does not properly sanitize input, allowing attackers to inject malicious scripts or HTML. This vulnerability can be exploited remotely without privileges but requires user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary web scripts or HTML in the context of the vulnerable application, potentially leading to information disclosure or limited integrity impact. The vulnerability does not affect availability. The medium CVSS score reflects the moderate risk posed by this XSS flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization on the notice_content parameter to mitigate injection risks. Monitor vendor channels for updates.