The vulnerability is a stored XSS flaw in Magnolia CMS’s image import function. An attacker with editor privileges can inject arbitrary HTML and JavaScript into the name field of an uploaded image. When a user opens that image, the malicious code is rendered and executed in the browser’s context, allowing the attacker to steal session cookies, hijack user sessions, deface the site, or inject further attacks. The flaw corresponds to CWE‑79. Based on the description, the likely attack vector requires an authenticated editor to upload an image with a crafted name, which is inferred from the available data.

This issue affects the Magnolia DXP: Magnolia CMS product. All releases prior to version 6.3.10 are vulnerable. The problem was addressed in version 6.3.10, which removes the ability to store scripts in image names.

The CVSS score of 5.1 indicates moderate severity. EPSS data is not published, and the vulnerability is not listed in CISA KEV. The attack requires an authenticated user with editor rights to upload an image and a victim user to view the uploaded image; this prerequisite is inferred from the description. Because the exploitation window is limited to users who interact with the import feature and view the image, the likelihood of large‑scale compromise is moderate but still noteworthy for sites with public browsing.