A stored cross‑site scripting flaw exists in SimpleChat when an authenticated group Owner, Admin, or DocumentManager uploads a group document with a crafted filename. The filename is later interpolated into an inline onclick handler in the group workspace page without properly escaping apostrophes. The flaw allows script to terminate the handler string and execute in the SimpleChat origin, providing the attacker with access to victim‑visible data and actions within the victim’s session.

Microsoft SimpleChat versions prior to 0.261.029 are affected. The vulnerability exists when uploading group documents via POST /api/group_documents/upload and is triggered when a group member clicks the Share button.

The CVSS score of 8.7 indicates high severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access with a group role of Owner, Admin, or DocumentManager, and succeeds when another group member clicks the Share button. Based on the description, the attack vector is an authenticated, privileged user uploading a malicious filename, and an uninformed group member triggering the handler. The high severity and lack of publicly known exploits necessitate immediate remediation.