A stored cross‑site scripting flaw exists in Esri ArcGIS Server 11.1 and earlier editions running on Windows and Linux. The vulnerability permits a remote unauthenticated attacker to store files that embed malicious code, which can then execute within the context of a victim’s browser when the file is accessed. This can lead to session hijacking, defacement, or other client‑side compromise.

Esri’s ArcGIS Server product is affected. All 11.1 and earlier releases on both Windows and Linux are vulnerable. The vendor provided a patch for versions that are in General Availability or Extended support status, covering 12.1, 12.0, 11.5, 11.3, and 11.1. Versions that are in mature or retired status are not patch eligible, and users operating other unlisted releases should upgrade or apply the available patch.

The CVSS score of 6.1 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited by any remote user who can write to the server’s file system in a way that the attacker can place a maliciously crafted file in a public location. The attack requires no authentication, and the compromised code runs in the victim’s browser, giving the attacker the same privileges as the victim. The risk is therefore moderate with a reasonable likelihood if the server is exposed to the internet and misconfigured to allow unauthenticated file writes.