This vulnerability arises from improper handling of intermediate data during resumable container image layer uploads in Red Hat Quay. The data is stored in a format susceptible to tampering, enabling potential arbitrary code execution on the server if exploited. The CVSS v3.1 score is 7.1, indicating high severity with network attack vector, high complexity, low privileges required, and user interaction needed. Red Hat has issued security advisories (RHSA-2026:19375 and RHSA-2026:21017) releasing fixed versions 3.16.4 and 3.14.8 of Red Hat Quay, which include bug fixes that mitigate this vulnerability.

Successful exploitation could lead to arbitrary code execution on the Red Hat Quay server, compromising confidentiality, integrity, and availability of the system. The vulnerability affects the container image upload process, potentially allowing attackers to manipulate stored data to execute malicious code. No known exploits in the wild have been reported at this time.

Red Hat has released fixed versions of Red Hat Quay (3.16.4 and 3.14.8) that address this vulnerability. Users should apply these updates after confirming that all previously released relevant errata have been installed. Detailed update instructions are available in the Red Hat advisories. No alternative mitigations or workarounds are specified in the vendor advisories.