A stored Cross‑Site Scripting flaw exists in the Interlinking feature of LaSuite Docs. When a collaborator with edit rights creates a link to another document, the link URL is not validated, allowing injection of a malicious javascript: URL. When other users click the link, the browser executes the embedded script, which can run arbitrary code in the context of the victim’s session.

The vulnerability affects the LaSuite Docs product from the suitenumerique vendor, specifically versions 3.8.0 through 4.3.0. Support for this issue was added in release 4.4.0, which removes the input validation flaw.

The CVSS score of 8.7 classifies this issue as high severity. Although the EPSS score is currently below 1 %, indicating a low likelihood of exploitation at present, the vulnerability remains significant because it requires only editing privileges that many users possess. The problem is not listed in the CISA KEV catalog, so no widespread exploitation has been reported, but the risk of insider or compromised user attacks exists.