Technical impact
The vulnerability is a cross‑site scripting flaw located in the Image Upload Endpoint of Mereithhh VanBlog, identified by CWE‑79 and CWE‑94. It allows remote attackers to supply a crafted image file that results in arbitrary JavaScript execution in the browser context of users who view the image. The CVSS score of 5.1 indicates moderate severity, and the existence of a publicly available exploit elevates the risk of exploitation in live installations. The vulnerability could allow session hijacking, cookie theft, or defacement of site content, compromising confidentiality, integrity, and availability.
Affected Systems
Affected versions of Mereithhh VanBlog include all releases up to 0.54.0, specifically the file packages/server/src/types/access/access.ts of the Image Upload Endpoint. No official patch is publicly available, and the vendor has not addressed the issue as of the latest advisory.
Risk and Exploitability
The attack can be performed remotely from an unprivileged attacker, and the public availability of an exploit suggests that automated scanners may already target this flaw. The EPSS score is not published, and the vulnerability is not listed in CISA's KEV catalog, but the moderate CVSS score combined with a real‑world exploit represents a non‑negligible threat vector for sites that rely on the image upload feature. Mitigation is required to prevent script execution in browsers that view uploaded content.
