A cross‑site scripting flaw exists when a user uploads a file that contains malicious content. When an administrator views the file information on the administration page, the malicious script runs in the admin’s browser. This allows the attacker to execute JavaScript in the context of the victim’s session, potentially enabling session hijacking, credential theft, or defacement. The weakness is a classic reflected XSS (CWE‑79).

The issue affects Fujitsu Japan Limited Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier releases. Any deployment of these versions is vulnerable.

The CVSS score of 4.8 denotes moderate severity, and no EPSS score is available, indicating limited public exploitation data. The vulnerability requires that a malicious file be uploaded and that a legitimate administrator open the resulting administration page, so exploitation typically involves internal or privileged users or social engineering. The flaw is listed as not in the CISA KEV catalog.