Flare, a self‑hosted file sharing application, allowed the upload of files without validating or sanitizing content. By embedding malicious JavaScript inside an SVG or other active content advertised as a raw file, an attacker can cause the script to run with the application’s origin when any user opens the file in raw mode. This stored XSS flaw enables the exfiltration of sensitive information or impersonation of the victim in the context of the site. The failure is a classic input validation weakness, classified as CWE‑79.

FlintSH’s Flare platform, versions 1.7.0 and earlier, are affected. The vulnerability is present in the general file preview functionality and is not limited to any particular deployment configuration. Version 1.7.1 remedies the issue.

The CVSS score is 4.6, indicating moderate severity, and the EPSS score is below 1 %, showing a low probability of exploitation at this time. The vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is inferred as a pre‑existing upload path; an attacker must first upload a crafted file to a Flare instance, then persuade a victim user to view the file in raw mode. Because the flaw involves stored input, anyone with write access can embed malicious payloads, and any authenticated or anonymous user who opens the file will be affected.