CVE-2026-33221

Katalog CVE

CVSS 5.3 · Medium EPSS 0,20%

Kerentanan Predictable Value Range from Previous Values pada nhost storage. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets. This issue has been patched in version 0.12.0.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-343: Predictable Value Range from Previous Values
CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nhost/nhost/security/advisories/GHSA-g9f6-9775-hffm mitigasi · advisory vendor
• https://github.com/nhost/nhost/commit/c4bd53f042d7f568e567e18e2665af81660fce85 patch
• https://github.com/nhost/nhost/pull/4018 issue tracking · patch
• https://github.com/nhost/nhost/releases/tag/storage%400.12.0 product · release notes