Server file write via subscriber upload

Arbitrary file upload in Warehouse Cargo 2.6.9 and earlier allows remote authenticated users to write files to the server. Patchstack has not disclosed the vulnerable upload endpoint or handler, so the public record does not identify whether the flaw is missing file-type validation, missing capability checks, or both. Subscriber access is required; the public record does not disclose whether that upload location executes script files, but any attacker-controlled upload still places arbitrary content on the host.