CVE-2026-66600: CWE-434 Unrestricted Upload of File with Dangerous Type in David Lingren Media LIbrary Assistant

This vulnerability (CWE-434) in Media LIbrary Assistant versions up to 3.39 permits an authenticated user with high privileges to upload files of any type without proper validation or restriction. This unrestricted file upload flaw can be exploited to execute arbitrary code, modify or delete data, or cause denial of service. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with high privileges to upload malicious files, potentially leading to full system compromise including data theft, data manipulation, or service disruption. The vulnerability affects confidentiality, integrity, and availability severely.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the upload functionality to trusted users only and monitor for suspicious activity related to file uploads.