OpenRemote before version 1.32.2 allows a stored cross‑site scripting vulnerability where authenticated users with write:admin permissions can upload HTML or SVG files that embed JavaScript. When a victim visits the image retrieval endpoint, the uploaded file is served with a Content‑Type of text/html or image/svg+xml, causing the embedded script to execute within the application's origin. This flaw enables attackers to run arbitrary client‑side code, potentially stealing user credentials or performing actions in the victim's session, without requiring direct access to the server.

Any deployment of OpenRemote core with a version older than 1.32.2 is affected. The vulnerability is tied to the manager configuration file upload endpoint and the unauthenticated image retrieval endpoint. No specific sub‑versions are listed beyond the major release boundary.

The CVSS score of 4.6 indicates a moderate risk level; the EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires an authenticated user with administrator permissions to upload the malicious file, and it succeeds when an end‑user is lured to the retrieval URL, so the attack vector is web‑based but relies on social engineering or phishing. The impact is confined to scripts running under the application's origin and does not provide remote code execution on the server."