The vulnerability arises from improper handling of resource types in Transloadit Uppy v0.25.6, causing a type mismatch that can lead to undefined behavior when the application processes mismatched data. This weakness is formally classified as CWE‑843, Access of Resource Using Incompatible Type. While the specific behavioral outcomes are not detailed in the advisory, type confusion can cause the application to crash, misinterpret data, or expose unexpected state, potentially disrupting service availability or compromising data integrity.

Transloadit Uppy v0.25.6 is identified as affected. No other vendor or product information is currently listed for this vulnerability. The issue is specific to the Uppy component used by Transloadit for handling uploads.

The CVSS base score is 9.8, EPSS probability is less than 1%, and it is not listed in KEV. This high severity score indicates significant risk despite the low likelihood of exploitation. Because no official patch or workaround is cited in the provided references, an affected organization would need to rely on its own safeguards. The likely attack vector would involve an attacker interacting with the Uppy service—most plausibly by supplying a crafted upload or request that triggers the type mismatch. The absence of a listed exploit in KEV suggests no publicly known active exploit, but the undefined behavior inherent in this class of bug warrants caution.