A stored cross‑site scripting flaw exists in LocalSend’s web share interface. When a file with a maliciously crafted filename is added, the app embeds that filename directly into the HTML list displayed by its local HTTP server. A victim who visits the share link executes the embedded script in the browser context of the LocalSend web interface, enabling arbitrary JavaScript execution that can read or manipulate the page, potentially stealing local data or mimicking user actions.

All installations of LocalSend up to and including version 1.17.0 are affected. The vulnerability resides in the web share interface served by the app’s built‑in HTTP server. The flaw is accessible whenever a user initiates a “Share via Link” session, regardless of the host operating system.

The CVSS score of 6.1 reflects medium severity, and the EPSS score of <1% indicates a low probability of widespread exploitation, with the vulnerability not listed in the KEV catalog. Attackers can exploit the flaw trivially by providing a file name containing script tags; once a victim opens the generated link on the local network, the malicious script runs. Because the attack requires the victim to visit the local share URL, the risk is moderate but can be significant in environments where devices are exposed to untrusted users or the link is distributed widely.