Chartbrew’s file upload API accepts any file based solely on its extension and stores it in a publicly served uploads directory. The lack of MIME type or content validation permits an attacker to upload an HTML file containing malicious script. When that file is served, the embedded JavaScript runs in the context of the site, potentially accessing authentication tokens stored in localStorage and leading to user account compromise.

All installations of Chartbrew built before version 4.8.4 are vulnerable. The issue is fixed in Chartbrew 4.8.4 and later releases.

The vulnerability carries a CVSS score of 6.3, indicating moderate severity, and an EPSS score of less than 1%, meaning the probability of exploitation is low. It is not listed in the CISA KEV catalog. The likely attack vector is a legitimate API call to the file upload endpoint, where an attacker can supply a crafted HTML file that is subsequently served without filtering, enabling stored XSS.