The avatar_uploader module for Drupal 7 contains a reflected cross‑site scripting flaw that lets an unauthenticated attacker inject JavaScript by modifying the "file" parameter in avatar_uploader.pages.inc. When a victim opens a URL crafted with a malicious payload, the script runs in their browser, silently enabling the attacker to steal or tamper with the victim’s session data, deface the site or redirect to malicious resources. This injection type directly affects the confidentiality and integrity of user interactions.

The issue is present only in the 7.x-1.0-beta8 release of the avatar_uploader project. Systems running the Drupal 7 platform with this module version are vulnerable; newer or non‑beta releases are not affected.

With a CVSS score of 5.1, the flaw is considered moderate. The EPSS score is not available and it is not listed in CISA’s KEV catalog. Attackers can leverage the vulnerability remotely by persuading users to visit a crafted link; authentication is not required. Because the exploit is straightforward—embed a script in a URL—the risk to browsers that execute arbitrary JavaScript is high, but the impact is limited to the victim session and any data accessed by that session.