The vulnerability stems from the storage service accepting the client‑provided Content‑Type header without any server‑side MIME type validation. As a result an attacker can send a file where the declared MIME type differs from the actual content, allowing the upload of files that bypass any MIME‑type restrictions that have been configured on storage buckets. This could lead to the storage of disallowed or potentially malicious files, compromising data integrity or exposure.

The flaw affects Nhost’s storage component in all releases prior to version 0.12.0. Any deployment of the Nhost storage service that has not applied the 0.12.0 update is vulnerable.

The CVSS score is 2.1, indicating low severity. No EPSS data is provided, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is a remote file‑upload request sent to the storage API; this is inferred based on the nature of the service. While the flaw does not enable remote code execution, it does allow authenticated clients to bypass policy controls, potentially compromising stored data.