The vulnerability arises from an incomplete cleanup routine that runs when users upload files to Misskey. The omitted cleanup fails to release storage space or close file descriptors, allowing an attacker to repeatedly upload files and eventually exhaust disk quotas or the system's available file handles. This shortage prevents legitimate uploads and can stop the entire instance from accepting any requests, which constitutes a denial‑of‑service condition. The weakness is classified as CWE‑459, indicating improper resource release.

Affected installations are those using the Misskey platform from version 13.0.0 up to 2025.4.1 inclusive, and from 2025.5.0 through 2026.7.0. All builds within those ranges are vulnerable. Version 2026.7.0 incorporates the fix and restores proper cleanup after uploads.

The CVSS score of 8.7 reflects high severity, and the EPSS score of 0.00501 indicates a very low but nonzero likelihood of exploitation. The lack of a CISA KEV listing suggests no publicly known exploits yet. Nevertheless, the attack path is straightforward: an adversary can trigger the flaw by sending a high volume of file uploads to any publicly accessible instance, regardless of federation settings. The resulting resource depletion would deny service to all users until the instance is restarted or resources are reclaimed.