The vulnerability resides in the Bulk Link API endpoint that accepts URL inputs without validating the scheme. An authenticated user can submit a link with a 'javascript:' URI. The stored URI is rendered unchanged within Blade templates, so when a victim clicks the link, the JavaScript executes in the victim's browser. This stored XSS can lead to exfiltration of cookies, session tokens, or other information accessible to the browser. The weakness is a classic stored cross‑site scripting flaw (CWE‑79).

All self‑hosted installations of Kovah:LinkAce before version 2.5.7 are affected. Genuine product under this CNA is LinkAce, with vulnerable bulk link API available in releases earlier than 2.5.7. The patch (2.5.7) eliminates format validation and prevents the storage of unsafe scheme URLs.

The CVSS score of 7.3 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user to create the malicious link and a separate victim user who subsequently visits or clicks the link. The vulnerability does not enable arbitrary code execution on the server but can compromise client‑side confidentiality and integrity. The typical exploitation chain involves a malicious actor adding a 'javascript:' link via the bulk API, and then tricking a victim into activating it, resulting in the execution of attacker‑supplied script.