The vulnerability lies in the file upload endpoint of zhistaredu StarTraining, leveraging MIME type processing in MimeTypeUtils.java to store arbitrary client‑supplied data as executable JavaScript. This weakness leads to a stored cross‑site scripting flaw that, once an attacker uploads a crafted file, can cause browsers to execute malicious scripts in the context of any user who later accesses the uploaded content. The CWE identifiers linked to this issue are CWE‑79 and CWE‑94, indicating typical XSS and code‑injection weaknesses.

Affected systems are zhistaredu StarTraining versions up to 3.8.1. The vulnerability is tied to the internal MimeTypeUtils component, though the precise classes and methods are not fully disclosed. The bug affects any deployment that exposes the upload endpoint without proper sanitization of the file metadata or content type.

The CVSS score of 5.1 denotes a moderate severity, but the publicly released exploit and the remote nature of the attack vector raise concerns. Exploit probability is not currently listed in EPSS and the vulnerability is not in the CISA KEV catalog, yet attackers could still leverage this flaw due to its ease of exploitation. Because the vendor did not respond to the disclosure, administrators should treat this as a potentially unpatched risk.