AIKIDO-2026-10734

TL;DR

Affected versions of this package allow a file size limit bypass in the FileUpload store_files tool because the max_file_size check trusts the client-controlled size field instead of validating the real decoded payload size. An attacker can exploit this by submitting a large base64-encoded file while falsely reporting a tiny size value, allowing oversized uploads that should have been rejected. It undermines the intended upload restriction and may enable resource exhaustion, storage abuse, or other downstream impacts depending on how uploaded files are processed.