High severity7.3NVD Advisory· Published Mar 16, 2026· Updated Jun 17, 2026
CVE-2026-4191
CVE-2026-4191
Description
A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=2.5
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.