The vulnerability arises from the file upload.php page when an attacker manipulates the 'filename' argument. This causes the application to store a filename that contains malicious script code, which is later executed in the browsers of users who view the uploaded image. The result is a classic reflected or stored cross‑site scripting (CWE‑79) that can allow attackers to run arbitrary JavaScript in the victim's context, potentially stealing session cookies, altering page content, or redirecting users to malicious sites. Because the payload is delivered via the filename field, it can be scoped to any user who can view the gallery, making the impact wide.

The affected product is the SourceCodester Modern Image Gallery App version 1.0. No other versions are listed, so only this specific build is confirmed vulnerable. The issue involves the upload functionality, and developers or administrators who run this application should verify if their instance matches the affected version.

According to the CVSS base score of 5.3, the vulnerability has moderate severity. The EPSS probability is below 1 %, indicating that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote: an attacker only needs to craft a malicious filename when uploading an image file, which is typically accessible from the public web interface. No additional credentials or local privileges are required, thus an unauthenticated attacker could exploit the flaw by submitting a crafted upload and then luring users to view the gallery.