This vulnerability (CVE-2026-66665) in Brandexponents Type Hub (versions <= 2.0.6) allows unauthenticated attackers to upload arbitrary files without restriction, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw enables attackers to potentially execute malicious code or disrupt system operations, resulting in complete compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high impact on all security properties. No patch or official remediation level has been published yet.

Successful exploitation can lead to full system compromise, including unauthorized code execution, data disclosure, data modification, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a critical level. Since the flaw is exploitable without authentication and user interaction, it poses a severe risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application, implement network-level controls to limit exposure, and monitor for suspicious file uploads or activity related to the Type Hub application. Avoid deploying the affected versions in exposed environments if possible.