Serviio PRO 1.8 contains a DOM‑based cross‑site scripting flaw in its mediabrowser component. Attackers can craft URLs that inject malicious payloads, which are read from document.location and subsequently rendered by document.write, allowing arbitrary HTML and JavaScript to execute in the victim’s browser. This client‑side code execution could be used for malicious browser actions such as defacing a page or hijacking a session, though the description does not detail specific downstream effects.

The vulnerability affects Serviio PRO 1.8 DLNA Media Streaming Server. Any instance running that exact version is vulnerable.

The CVSS score of 5.1 places the flaw in the medium severity range, and an EPSS score of less than 1% indicates a low probability of exploitation in the real world. The vulnerability is not listed in the CISA KEV catalog. Attackers must lure a user to a specially crafted URL that the mediabrowser component processes; when the URL is read into document.location and passed to document.write, the injected code executes in the victim’s browser context. This requires user interaction and does not compromise the server, but it grants the attacker full client‑side control.