A stored cross‑site scripting flaw exists in UVdesk core‑framework before 1.1.7. The flaw allows an attacker who holds the ROLE_AGENT privilege to inject arbitrary JavaScript into the configuration identifier field of the createMailerConfiguration action. This payload is persisted and executed automatically when other members load the configuration update page. The vulnerability is a classic input validation and HTML encoding weakness (CWE‑79) that compromises confidentiality and integrity by enabling script execution in the context of any user who views the affected page.

The affected products are UVdesk community‑skeleton and UVdesk core‑framework. Any installation running a version prior to 1.1.7 is vulnerable. The vulnerability was addressed in the 1.1.8 release, which supersedes the 1.1.7 snapshot that introduced the flaw.

The CVSS score of 5.1 indicates medium severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no known large‑scale exploitation yet. Because the exploit requires a user to possess the ROLE_AGENT privilege, an attacker with that role can forge the injected script. The injected script will run for any other authenticated user who visits the configuration update page, allowing session hijacking, defacement, or data theft. The attack vector is through web application interaction rather than remote network exploitation, but the impact can be significant for organizations that trust agents to perform management tasks.