File Thinghie version 2.5.7 contains a reflected Cross‑Site Scripting flaw that allows an attacker to inject and execute arbitrary JavaScript code in the victim’s browser. The missing input validation on the "dir" query parameter leads to script execution on page load, creating risks of session hijacking, cookie theft, defacement and further client‑side attacks that affect confidentiality, integrity and user experience.

The vulnerability is confined to installations running the specific "leefish" File Thinghie product version 2.5.7. No other versions or related products are listed as affected.

The CVSS score of 6.5 indicates moderate severity, while the EPSS rate below 1% suggests a low probability of active exploitation at this time. The flaw is not present in CISA’s KEV catalog, implying no widely confirmed exploitation. The likely attack path requires a victim to visit a crafted URL containing malicious JavaScript in the "dir" parameter – for example via social‑engineering or phishing emails – to trigger reflected execution in their browser.