Quark Drive versions before 0.8.5 contain a stored cross‑site scripting flaw on the System Configuration page. Attackers who are authenticated can submit malicious HTML or JavaScript as key names through the POST /update endpoint. These values are persisted and rendered without escaping by Vue.js's v-html directive, causing any authenticated user who opens the System Configuration tab to execute the payload in their browser. The consequence is session cookie theft and execution of arbitrary authenticated actions.

The vulnerability affects the Quark‑Drive application by Cp0204, specifically all releases older than 0.8.5. Users of these versions that grant authenticated access to the System Configuration page are vulnerable, regardless of the operating system or deployment platform.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is not available, meaning no data is available to gauge current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog, suggesting no documented exploitation yet. Exploitability requires valid user credentials; once authenticated, the attacker can inject payloads that will run in other users’ browsers. Because the payload runs in-browser, an attacker can steal session cookies or perform further authenticated actions within the application.