A stored cross‑site scripting vulnerability exists in Kiamo before version 8.4, caused by improper output encoding of user‑supplied input in administrative interfaces. An authenticated administrator can inject arbitrary JavaScript code that is executed in the browsers of users who view the affected pages. The vendor has released a fix for the 8.3.1 branch prior to the CVE record, indicating that updates before 8.4 are available.

All installations of Kiamo with a version older than 8.4 are impacted. The flaw resides in the administrative interfaces and requires administrator‑level authentication to inject the malicious script.

The CVSS score is 5.4, indicating a medium severity. EPSS shows an exploitation probability of less than 1 %, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a user with administrative privileges to inject the payload; once injected, any user who accesses the affected interface will run the JavaScript in their browser.