The flaw occurs in the File Upload API component of OpenAkita. When a user uploads a file through the /api/upload endpoint, the filename argument is not sanitized, allowing an attacker to inject malicious JavaScript that is subsequently rendered by the victim’s browser. The input validation weakness (CWE‑79) enables the attacker to compromise the confidentiality and integrity of session data and execute arbitrary code within the victim’s context. The vulnerability is tied to an additional code path (CWE‑94) that may permit dynamic code execution if the upload is processed by a server-side scripting engine. The impact is limited to browsers that render the injected content, meaning that a cross‑site scripting (XSS) event can be triggered when the victim opens the uploaded file or visits a page displaying it.

OpenAkita versions up to and including 1.27.12 are affected. The vulnerability originates from an unknown code segment in the /api/upload file of the File Upload API component. No specific build or configuration variations are documented, so all deployments of the affected versions should be considered vulnerable.

The CVSS score of 2.3 indicates a low severity. The EPSS score is unavailable, but the public release of the exploit suggests that real‑world attacks have the potential to occur. The exploit requires remote interaction, a relatively high level of complexity, and is considered difficult to execute, implying that attackers must invest effort to craft a malicious payload. At present, the flaw is not listed in the CISA KEV catalogue, but the existence of a public exploit warrants immediate attention.