A reflected cross‑site scripting vulnerability has been identified in the DocsController of Milk admin (≤0.9.8). The flaw allows a remote party to supply crafted input via the 'action' query parameter, which the application returns unsanitized. When a victim's browser renders the affected page, the injected script or HTML executes in the context of the site, enabling session hijacking, defacement, or client‑side phishing. This weakness is a classic example of improper input neutralization.

The issue affects all installations of Milk admin version 0.9.8 and earlier. The vulnerable code resides in Modules/Docs/DocsController.php. No commercial vendor is listed; the project is an open‑source application maintained on GitHub.

It is not stated whether the endpoint requires authentication to access the 'action' parameter; based on the description, it is inferred that the flaw may be exploitable through a crafted request without authentication, but this inference is not explicit. The CVSS score is 6.1, indicating moderate severity. The EPSS score of less than 1% suggests a low but non‑zero likelihood of widespread exploitation. The issue is not listed in the CISA KEV catalog. Because the affected code executes arbitrary scripts in the victim’s browser, the impact is that an attacker can steal session cookies and perform client‑side attacks, potentially compromising any authenticated user who visits the page.