The vulnerability allows attackers to upload arbitrary HTML files to MagicINFO 9 Server. Because the server fails to validate the file type, the uploaded content is stored and later rendered in the web interface, enabling stored cross‑site scripting under CWE‑434. A malicious script can then be executed in the browser context of any authenticated user, providing a path to hijack accounts and compromise data integrity.

Affected systems are Samsung Electronics MagicINFO 9 Server versions prior to 21.1090.1. The issue is specific to the file‑upload component of the server software.

The CVSS score of 9.8 indicates critical severity, and while the EPSS score is below 1 %, the exploit potential remains significant in targeted environments where the application is publicly exposed. The attack requires a valid user session to upload files, but no additional authentication or privileges are enforced, making it feasible for authenticated or compromised accounts to execute malicious scripts.