Saleor, an open‑source e‑commerce platform, suffers an arbitrary file upload flaw that allows authenticated staff users or applications to upload any file type, including malicious HTML and SVG that contain JavaScript. The uploaded files are stored and later served from the same domain as the administration dashboard without proper content‑type handling. When a user visits the URL, the browser renders the file and executes the embedded scripts in the context of that user’s session. This stored cross‑site scripting can lead to theft of session cookies, access or refresh tokens, or other in‑browser data, effectively allowing an attacker to hijack other staff accounts.

Affected vendor is Saleor. The vulnerability exists in Saleor versions from 3.0.0 up to (but not including) the patch releases 3.20.108, 3.21.43, and 3.22.27. The issue is only exploitable when media files are served from the same domain as the administration interface and the server does not set a Content‑Disposition: attachment header, and Saleor Cloud deployments are not affected.

With a CVSS score of 8.5, this vulnerability is classified as High severity. The EPSS score is below 1%, indicating a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers need legitimate staff credentials or a compromised application token to use the upload functionality, and the media must be reachable under the same domain as the admin UI. Once uploaded, the malicious content is served without sanitization, allowing the script to run in any staff member’s browser and potentially capture session tokens or perform other malicious actions.