The vulnerability resides in the file upload handler of cskefu, specifically the MediaController.java component. It permits an attacker to inject arbitrary client‑side script through the upload function, enabling cross‑site scripting. Attacks can be performed remotely by submitting a crafted file, and the injected code may run in the browsers of other users viewing the uploaded content. The weakness is classified as CWE‑79 and CWE‑94, indicating user‑controlled data is executed as code.

Affected are all releases of the cskefu application up to version 8.0.1. Users running 8.0.1 or earlier are susceptible; versions beyond 8.0.1 have not been verified but should be considered potentially patched.

The CVSS base score is 5.1, representing a medium severity risk, and the EPSS score is below 1%, indicating a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires remote access to the file upload endpoint, and the publicly disclosed exploit suggests an attacker must be able to reach the exposed MediaController route. No vendor workaround is provided.