A flaw in the attachment upload logic allows an authenticated user to upload a file whose MIME type is set to text/html. The application later serves that file inline, so any JavaScript included in the file runs in the browser under the application's origin. This stored cross‑site scripting can compromise confidentiality, integrity, and availability of user sessions and data for anyone who follows the shared link.

Products from Banq named Jivejdon, any release up through version 5.0, are vulnerable. No specific patch version is listed, so all installations of the 5.x line should be examined for the described upload functionality.

The vulnerability carries a CVSS score of 5.1, indicating a medium severity risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it hasn’t yet been widely exploited. Attackers need only authenticated access to upload the malicious file, which can then be shared as a link; viewing the link triggers the JavaScript in the victim’s browser.