A stored cross‑site scripting flaw exists in PandaWiki when administrators upload an HTML file that is named with an image extension. The upload endpoint accepts the file and a subsequent request to /static‑file/<key>?a=.pdf serves the file inline by bypassing nginx’s attachment header. The rendered HTML steals the panda_wiki_token JWT, allowing an attacker to take over the administrator session without requiring the user’s credentials. This flaw is classified as CWE‑79 and results in a moderate risk of unauthorized access and potential data compromise.

Chaitin’s PandaWiki versions 3.65.0 through 3.87.5 are affected. The issue is present in all releases within this range, regardless of deployment environment, as the vulnerable upload and static‑file handlers are included in the core distribution.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting lower current exploitation prevalence. Nevertheless, exploitation is straightforward: an unauthenticated attacker can upload the crafted file, then disclose a download link to an administrator. If the admin follows the link, the session token is captured. The attack requires only the ability to reach the upload endpoint and to entice the target to click the download link, both of which are commonly feasible in many environments.