Indico, an event‑management platform, is affected by a cross‑site scripting flaw that occurs when users upload certain file types as materials in versions prior to 3.3.10. The vulnerability permits malicious JavaScript to be injected into the page that displays the uploaded material, allowing an attacker to execute code within the context of any user who views the material. The impact is limited to the content displayed to users, and an attacker could alter the appearance of the page or deliver malicious payloads when the script runs in the victim’s browser.

The affected product is CERN’s Indico event‑management system (indico:indico). All releases older than v3.3.10 are impacted. Versions 3.3.10 and newer contain the fix that removes the XSS vector.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% indicates that the vulnerability is considered unlikely to be widely exploited at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user able to upload a specially crafted material file; after upload any other user who views the material will be exposed to the injected script. Updating to v3.3.10 removes the vulnerability. For deployments that cannot be upgraded immediately, applying the strict Content‑Security‑Policy for material download endpoints via the web‑server configuration (or limiting upload privileges to trusted users) can mitigate the risk.