Description
A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-15
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted Remote File Upload
Action: Patch Now
AI Analysis

Impact

JawherKl node-api-postgres contains a flaw in its Profile Picture Handler where the path.extname function is improperly used, allowing an attacker to upload any file type without restriction. This vulnerability leads to a remote file upload that could compromise confidentiality, integrity, and availability of the affected system. The weakness is linked to CWE-284 (Broken Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).

Affected Systems

The product affected is JawherKl node-api-postgres. All releases up to and including version 2.5 are vulnerable to this flaw.

Risk and Exploitability

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is less than 1%, suggesting a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The exploitation is possible over the network via the file upload endpoint; an attacker can upload arbitrary files potentially leading to further compromise if the uploaded file is executed or used to access sensitive data.

Generated by OpenCVE AI on March 16, 2026 at 23:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade JawherKl node-api-postgres to a version newer than 2.5 that corrects the misuse of path.extname.
  • If an upgrade is not yet possible, enforce strict file type validation: limit uploads to allowed image extensions (.jpg, .jpeg, .png, .gif) and verify MIME types before acceptance.
  • Configure the application firewall or WAF to scrutinize upload requests and block suspicious payloads.
  • Monitor application logs for anomalous upload activity and investigate promptly.

Generated by OpenCVE AI on March 16, 2026 at 23:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 16 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Jawherkl
Jawherkl node-api-postgres
Vendors & Products Jawherkl
Jawherkl node-api-postgres

Sun, 15 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload
Weaknesses CWE-284
CWE-434
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Jawherkl Node-api-postgres
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-16T20:10:57.488Z

Reserved: 2026-03-14T22:40:41.486Z

Link: CVE-2026-4191

cve-icon Vulnrichment

Updated: 2026-03-16T20:10:53.143Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-16T14:20:02.427

Modified: 2026-03-16T14:53:07.390

Link: CVE-2026-4191

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T14:01:12Z

Weaknesses