The vulnerability occurs when the application stores file names that have not been sanitized, allowing an attacker to embed malicious script code into the metadata stored for a file. When a user opens or views that file, the embedded script is executed in the user's browser, which can break session integrity or cause unintended browser actions. The vulnerability is a classic stored XSS flaw and is classified as input validation and cross‑site scripting (CWE‑20, CWE‑79).

Intermesh Group‑Office 6.8.148 and earlier, as well as 25.0.1 through 25.0.79 are affected. The fix is available in 6.8.149 and 25.0.80.

The CVSS score of 5.1 indicates a moderate impact, while the EPSS score of <1% suggests exploitation is unlikely in the short term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious file name during an upload or file‑creation operation, after which the victim must interact with the file in the application. The risk is confined to the file‑viewing context but can still be used to interfere with user sessions or trigger unexpected client‑side behavior.