A vulnerability was found in JawherKl node-api-postgres up to 2.5. It has been classified as critical. Affected is the function
path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload.
This vulnerability is tracked as CVE-2026-4191. The attack is possible to be carried out remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
