A code injection vulnerability exists in the validateAccess function of provectus kafka‑ui’s /api/smartfilters/testexecutions endpoint. Because user input is not properly validated, an attacker can execute arbitrary code on the server hosting the service, compromising confidentiality, integrity, and availability of the system. The vulnerability is exploitable remotely via crafted requests to the affected endpoint. These vulnerabilities arise from improper input handling (CWE-74) and the execution of arbitrary code from user‑controlled inputs (CWE-94).

The flaw affects provectus kafka‑ui versions up to and including 0.7.2. Any deployment of these or earlier releases that exposes the /api/smartfilters/testexecutions API to external clients is vulnerable.

The CVSS score for this issue is 6.9, indicating a moderate to high severity. The EPSS score of 3% indicates a low but non‑negligible likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but published exploit code is publicly accessible. The attack vector is remote, as an attacker only needs to send malicious requests to the exposed API endpoint, making exploitation straightforward for an adversary with network access to the service.