Initiative, a self‑hosted project management platform, is affected by a stored cross‑site scripting flaw in its document upload feature. Versions prior to 0.32.4 allow users with upload rights to place a malicious .html or .htm file that the application serves from its own domain. The embedded JavaScript runs in the context of the application, permitting an attacker to capture authentication tokens, session cookies, or other sensitive data and send it to a remote server, thereby achieving credential theft and data exfiltration. Because the file is hosted under the application’s domain, any user who opens a shared link can trigger the same attack, magnifying the potential impact.

Morelitea Initiative is the affected product. All releases earlier than version 0.32.4 are impacted. Users who run the Initiatives section and have upload permissions are at risk.

The CVSS score of 8.7 indicates high severity. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. An attacker who can upload documents, such as an insider or a compromised user, can deliver the malicious file. Once a user opens the file, the script executes in their browser session, enabling the attacker to exfiltrate authentication tokens, session cookies, or other sensitive data.