A reflected XSS flaw is present in the zipPath POST parameter of tiki-admin_system.php, enabling an attacker to inject and execute arbitrary JavaScript when a form is submitted. The malicious code runs within the victim’s browser, allowing actions such as session hijacking or credential theft. This weakness is a classic input validation issue where output is not properly sanitized or encoded.

The vulnerability applies to Tiki CMS version 21.2. Site administrators should verify that their installation matches this version and, if so, update to the latest 21.x LTS release that addresses the XSS problem. It is not related to any other documented product versions.

The flaw carries a moderate severity rating with an overall score of 5.4, indicating a non‑critical but meaningful risk. The likelihood of exploitation is very low—under 1%—and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to deliver a crafted POST request to tiki-admin_system.php, which requires the victim to load or submit a form containing malicious data. Because the issue is client‑side, the damage is limited to the victim’s browser session, but any compromised user could unintentionally expose sensitive information.