Aiflowy versions 2.1.2 and earlier contain a cross‑site scripting (XSS) flaw located in the UploadController.java file, which allows a remote attacker to submit malicious content via the upload endpoint. The CVE description specifies that this can enable the attacker to obtain sensitive information. Whether the vulnerability permits arbitrary script execution is not explicitly stated; however, XSS commonly permits injection and execution of scripts, so this is inferred from typical XSS behavior.

All installations of Aiflowy up to and including version 2.1.2 are affected because the upload endpoint does not filter or sanitize user‑supplied input. No other product versions are referenced as vulnerable.

The CVSS score of 6.1 indicates medium severity, and the EPSS score of less than 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to trigger the file‑upload endpoint, typically by sending a crafted request that contains malicious content. The attack vector is presumed to be remote via the upload interface, and conditions for successful exploitation would likely include the acceptance of the uploaded file and rendering of its content within a browser context.