The vulnerability CVE-2026-11621 affects Dcat-Admin versions up to 2.2.3-beta. It arises from improper validation in the editorMDUpload function handling the editormd-image-file parameter in the User Setting Page component. This flaw permits unrestricted file uploads via the /admin/dcat-api/editor-md/upload endpoint, which can be triggered remotely. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No vendor advisory or patch information is currently available, and the exploit is publicly known.

Successful exploitation allows remote attackers to upload files without restriction, which could lead to unauthorized file storage on the server. While the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, the ability to upload arbitrary files may facilitate further attacks depending on the environment and file handling.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected upload endpoint and monitor for suspicious file uploads. Implement additional validation or filtering on uploaded files if possible.