Technical impact
The vulnerability is a stored cross‑site scripting flaw that permits authenticated users to embed malicious raw HTML or javascript: Markdown links in bundle descriptions. When a recipient views the public bundle preview page, the injected script is executed via Alpine's x-html attribute, allowing the attacker to read the victim's owner_token from localStorage and then perform owner‑scoped requests against the victim's bundles.
Affected Systems
Axeloz Filesharing installations running any version prior to 2.14.3 are affected. The flaw resides in the server‑side rendering of bundle descriptions and exists across all operating systems where the web application runs.
Risk and Exploitability
The CVSS score is 5.1, indicating moderate impact. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploit requires the attacker to be an authenticated user who can edit a bundle description, and a separate victim must later view the public preview page for the injected script to run. While the flaw allows theft of an owner_token and impersonation of the owner in the victim's browser, it does not provide direct server‑side code execution or compromise of the host machine. The attack surface is limited to users who can modify bundle descriptions and view previews, making the risk moderate but still significant for environments that grant many accounts such permissions.
