In bbs-go version 4.4.6, authenticated users can craft a multipart POST to /api/upload with a spoofed Content‑Type header, enabling the upload of HTML or SVG files. Those files are then served inline from /res, allowing attacker‑supplied scripts to execute in the browsers of administrators who receive the URLs. This stored XSS can compromise administrator sessions, deface the forum, or move laterally within the system.

The vulnerability affects mlogclub’s bbs‑go product version 4.4.6.

The CVSS score of 5.1 places this flaw in the medium severity range. Exploitation requires the attacker to be an authenticated user able to upload a file, and the attack is most effective when an administrator follows a malicious URL. The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating it has not been publicly reported as a widely exploited weakness. Nonetheless, because the flaw allows arbitrary script execution in privileged contexts, the risk to confidentiality, integrity, and availability of the forum is significant if the attack conditions are met.