The vulnerability is a stored cross‑site scripting flaw in userSpice 4.3.24, specifically in the backup.php endpoint. Malicious payloads injected through the X-Forwarded-For HTTP header are reflected and executed when administrators view the audit log page. This allows an attacker to run arbitrary JavaScript in the context of the administrator’s browser, potentially stealing session cookies or performing other malicious actions. Attackers do not need privileged credentials; they simply craft a request with a malicious header.

UserSpice userSpice version 4.3.24. No other product versions are listed, so the risk is confined to installations running that exact version. Administrators of userSpice deployments should verify if they are running 4.3.24 and plan an update accordingly.

The CVSS v3.1 score is 5.1, indicating medium severity. Because the flaw is remotely exploitable over HTTP, an attacker can target the exposed web interface without authentication. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which reduces the confidence that it is actively exploited in the wild. Nonetheless, any admin using the audit log with XSS payloads could execute arbitrary code in the admin’s browser, so the risk to confidentiality and integrity of the admin session is significant. The attack vector is remote, via crafted HTTP requests to the backup.php endpoint.