CMDBuild 3.3.2 includes multiple stored XSS flaws that let authenticated users inject arbitrary scripts or HTML into the system. By submitting crafted data when creating employee cards or uploading SVG attachments to the classes endpoint, an attacker can store malicious payloads. When other users open those records or preview the attachments, the payload runs in their browser context, potentially stealing session cookies, defacing the UI, or launching further phishing or credential‑stealing attacks. This is a typical CWE‑79 reflection issue that can cause confidentiality or integrity risks to all users who view the affected content.

The affected product is CMDBuild from the Cmdbuild vendor, specifically version 3.3.2. The vulnerability is triggered by authenticated users interacting with card creation or file upload endpoints. No other versions are known to be affected from the supplied data.

With a CVSS score of 5.1 the risk is medium. The EPSS score is not available, so no quantified likelihood of exploitation is provided, and the vulnerability is not listed in the CISA KEV catalog. Attackers need valid credentials to create the malicious content, but once stored the XSS executes in the browser of any user who visits the record or opens the attachment, giving the attacker an opportunity to compromise a broader set of users. The absence of a public exploit in the references suggests the attack vector remains theoretical, yet the vulnerability is sufficient to warrant remediation.