PT-2026-25565 · Jawherkl · Node-Api-Postgres

Vuldb + 1 · Publicado 2026-03-15 · Atualizado 2026-03-16 · CVE-2026-4191

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JawherKl node-api-postgres versions up to 2.5

Description A flaw exists in the Profile Picture Handler component of JawherKl node-api-postgres. Specifically, the path.extname function within the index.js file is susceptible to manipulation, leading to unrestricted file upload. This issue can be exploited remotely.

Recommendations Versions prior to 2.5 should be used.

Exploit

Correção

Improper Access Control

Unrestricted File Upload

Enumeração de Fraquezas

CWE-284

CWE-434

Identificadores relacionados

CVE-2026-4191

Produtos afetados

Node-Api-Postgres

Referências · 7

• 🔥 https://hackmd.io/@YzU_KiOzT86cEbFQdBceVg/Bk56LQQYbe · Exploit
• https://vuldb.com/?ctiid.351098 · Nota
• https://twitter.com/CVEnew/status/2033361067062006070 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4191 · Nota de Segurança
• https://vuldb.com/?id.351098 · Nota
• https://t.me/CVEtracker/47465 · Publicação no Telegram
• https://vuldb.com/?submit.770002 · Nota