HomeBox, a home inventory and organization system, contains a stored XSS flaw in its item attachment upload functionality. The application fails to enforce file type validation, which allows an authenticated user to upload malicious HTML or SVG files embedding executable JavaScript. When a victim user opens such an attachment through a direct link, the script runs in the context of the application’s origin, allowing the attacker to steal session data, modify page content, or execute further client‑side attacks.

Sysadminsmedia’s HomeBox software, versions earlier than 0.24.0‑rc.1, is affected by this issue. The vulnerability applies to all installations of these versions regardless of operating system, as the flaw is in the web application code.

The CVSS base score of 4.6 indicates moderate severity, and the EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user to upload the malicious file, but any user who opens the resulting attachment is exposed to the embedded script, enabling widespread impact across the user base.