The vulnerability allows an attacker to inject arbitrary JavaScript into the browser by crafting an HTTP request with an invalid MIME type, causing the preview engine to perform MIME sniffing and treat the content as an SVG that executes embedded scripts. This flaw is an example of improper input neutralization and is identified as CWE‑79. Successful exploitation permits the attacker to run malicious scripts in the context of the victim’s session, enabling data theft, session hijacking or defacement. The CVSS score of 6.1 indicates moderate severity, but the EPSS score of less than 1% suggests that attacks are currently rare. The issue is not listed in the CISA KEV catalog.

The flaw affects the Jirafeau project’s Jirafeau file‑sharing application. All installations running a version prior to 4.7.1 are vulnerable. The vendor recommends upgrading to version 4.7.1, which removes the bypass that permits the invalid MIME type to trigger the preview.

Because the flaw can be triggered through a crafted preview request, an attacker only needs to send the malicious request from any network that can reach the Jirafeau instance. There is no prerequisite of user authentication; the vulnerability could be exploited by a public attacker who can force the browser to display the preview. The low EPSS score implies that, at present, there is little observed exploitation, but the moderate CVSS score and the nature of XSS recommend immediate response. No marketplace exploitation has been reported, but the flaw does not appear in KEV, meaning there is currently no known large‑scale exploitation campaign.