Which versions of PostgreSQL are affected by CVE-2026-4191?

A critical vulnerability in the node-api-postgres library enables attackers to upload arbitrary files to systems using affected versions, potentially leading to data breach, malware deployment, or…

Is there a public PoC exploit available for CVE-2026-4191?

Yes, a public proof-of-concept exploit is available for CVE-2026-4191. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4191?

Within 24 hours: Identify all systems and applications using node-api-postgres library and document their versions; implement network access restrictions to profile picture upload endpoints. Within 7 days: Audit logs for suspicious file upload activity; deploy WAF rules to block requests with suspicious file extensions; disable profile picture upload functionality if not critical to operations. Within 30 days: Migrate to alternative libraries with active maintenance or implement a custom file upload handler with strict validation; establish vendor monitoring process for this and similar dependencies.

PostgreSQL CVE-2026-4191

Q: What is the CVSS score of CVE-2026-4191?

CVE-2026-4191 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12253 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-15 VulDB

File Upload PostgreSQL

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 22, 2026 - 21:37 NVD

HIGH MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 15, 2026 - 21:00 euvd

EUVD-2026-12253

Analysis Generated

Mar 15, 2026 - 21:00 vuln.today

CVE Published

Mar 15, 2026 - 20:02 nvd

HIGH 7.3

DescriptionCVE.org

A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A critical unrestricted file upload vulnerability exists in the Profile Picture Handler component of JawherKl's node-api-postgres library (versions up to 2.5), where improper validation in the path.extname function of index.js allows attackers to upload malicious files remotely without authentication. A proof-of-concept exploit is publicly available, making this vulnerability actively exploitable, though it is not currently listed in CISA's KEV catalog and no EPSS score is provided.

Technical ContextAI

The node-api-postgres library (CPE: cpe:2.3:a:jawherkl:node-api-postgres:*:*:*:*:*:*:*:*) is a Node.js API framework that integrates with PostgreSQL databases. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), where the path.extname function in the Profile Picture Handler fails to properly validate file extensions and types. This allows attackers to bypass intended upload restrictions and potentially upload executable files, web shells, or other malicious content. All versions from 2.0 through 2.5 are confirmed vulnerable according to ENISA EUVD data.

RemediationAI

No official patches are available as the vendor did not respond to disclosure attempts. Immediate mitigation steps include: 1) Disable or remove the Profile Picture Handler functionality if not critical, 2) Implement strict server-side file type validation beyond relying on path.extname, 3) Use a whitelist approach for allowed file extensions, 4) Store uploaded files outside the web root, 5) Consider migrating to an actively maintained alternative library. Monitor VulDB (ID: 351098) for any future vendor responses or patches.