IBM Aspera Shares versions 1.9.9 through 1.11.0 allow a remote attacker to inject malicious HTML content that is rendered by a victim’s web browser. The injected code runs within the security context of the Aspera Shares site, potentially enabling session hijacking, phishing, or data exfiltration. This vulnerability is identified as a stored HTML injection flaw (CWE-80) and could be used to compromise confidentiality or integrity of user data.

IBM Aspera Shares is the affected product, with vulnerable releases including 1.9.9, 1.10, and 1.11.0. All customers running these versions are at risk until they upgrade to the patched build 1.11.1.

CVSS base score of 4.8 indicates medium‑low severity, and EPSS below 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need access to the web interface of the application to inject HTML, after which the victim’s browser execution would provide the attacker the payload while operating under the website’s security context.