LibreDesk versions before 2.9.0‑rc.8 contain a stored cross‑site scripting flaw that allows authenticated users to upload SVG files with a malformed Content‑Type header. When the file is later served from the /uploads/{uuid} endpoint, it is rendered inline without a sandbox, enabling the embedded script to execute in the browsers of any user who views the SVG, including administrators. The vulnerability therefore threatens confidentiality, integrity, and availability by permitting arbitrary script execution across user sessions.

The affected software is LibreDesk, as identified by its CNA vendor product name \"abhinavxd:libredesk\". All installations running a version earlier than 2.9.0‑rc.8 are vulnerable; the specific version must be verified against the product's documentation or release notes.

The CVSS score of 5.1 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, implying no confirmed exploitation as of this analysis. Attackers must be authenticated to the system, but the extremely low exploitation probability combined with the serious potential impact means that administrators should plan to address the issue promptly.