A code injection vulnerability exists in the validateAccess function of provectus kafka‑ui’s /api/smartfilters/testexecutions endpoint. Because user input is not properly validated, an attacker can execute arbitrary code on the server hosting the service, compromising confidentiality, integrity, and availability of the system. The vulnerability is exploitable remotely via crafted requests to the affected endpoint.

The flaw affects provectus kafka‑ui versions up to and including 0.7.2. Any deployment of these or earlier releases that exposes the /api/smartfilters/testexecutions API to external clients is vulnerable.

The CVSS score for this issue is 6.9, indicating a moderate to high severity. EPSS data is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but published exploit code is publicly accessible. The attack vector is remote, as an attacker only needs to send malicious requests to the exposed API endpoint, making exploitation straightforward for an adversary with network access to the service.