File Thingie 2.5.7 allows a malicious user to inject arbitrary JavaScript by uploading a file whose name contains a payload. This stored cross‑site scripting flaw can execute in the browser of any visitor who views the uploaded file, enabling session hijacking, phishing, or defacement. The weakness is identified as CWE‑79.

The vulnerable product is File Thingie from the vendor Leefish, specifically version 2.5.7. No other versions are mentioned as affected.

The CVSS score is 6.5, indicating moderate severity, and the EPSS score is below 1 %, suggesting low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. Attackers can trigger the XSS simply by accessing the upload page and supplying a crafted file name, so no privileged access is required. If the application is publicly reachable, every end‑user could be impacted by the injected code.