How severe is CVE-2026-33221?

CVE-2026-33221 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2026-33221 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-33221?

CVE-2026-33221 affects Nhost Storage. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-33221?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-33221 have an EU (EUVD) identifier?

Yes. CVE-2026-33221 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-13877.

When was CVE-2026-33221 published?

CVE-2026-33221 was published on 2026-03-20 and last updated on 2026-06-17.

CVE-2026-33221

CVE-2026-33221 is a medium-severity vulnerability in Nhost Storage with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-343.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 2.1
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-13877
Weakness: CWE-343
Affected product: Nhost Storage
Published: 2026-03-20
Last modified: 2026-06-17

Description

Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets. This issue has been patched in version 0.12.0.

Frequently asked questions

What is CVE-2026-33221?: Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets. This issue has been patched in version 0.12.0.
How severe is CVE-2026-33221?: CVE-2026-33221 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2026-33221 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-33221?: CVE-2026-33221 affects Nhost Storage. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-33221?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-33221 have an EU (EUVD) identifier?: Yes. CVE-2026-33221 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-13877.
When was CVE-2026-33221 published?: CVE-2026-33221 was published on 2026-03-20 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:nhost:storage:*:*:*:*:*:*:*:*

Other CWE-343 vulnerabilities

CVE-2026-32694 — Medium (CVSS 6.6): In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret…
CVE-2014-5409 — Medium (CVSS 6.4): The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly…

Browse all CWE-343 vulnerabilities →