The vulnerability permits authenticated backend users with album edit rights to inject JavaScript via the album URL field; the input is stored without escaping and is later rendered inside an unescaped attribute of DialogAlbumSettings.html. When an administrator opens the affected album, the stored script executes within that administrator's backend session, allowing arbitrary JavaScript to run in the administrative context.

Webasyst Framework installations version 4.4.0 or earlier that contain the Photos application are affected. The CVE description references the vulnerability in versions up to 4.4.0.

The CVSS score of 5.1 indicates a moderate risk rating. Exploitation requires an authenticated backend user who has album edit permissions, making the attack vector internal. The vulnerability is not currently listed in CISA KEV and the EPSS score is unavailable, suggesting limited known exploitation.