The vulnerability is a stored cross‑site scripting flaw (CWE‑79) in the VitaFit cloud API that allows an authenticated attacker to upload an SVG image containing malicious JavaScript to a shared storage bucket. When a victim opens the file by navigating to its URL in a browser, the script executes in the victim’s browser context, potentially leaking data or hijacking the session.

The affected product is VitaFit from Shenzhen Shine Industrial Co., Ltd. All releases prior to 2026‑10‑30 are vulnerable because the API does not restrict or sanitize scripts embedded in uploaded SVG files.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves authenticating to the API, uploading a crafted SVG, and persuading or tricking a user to navigate to the file URL. Successful exploitation would allow arbitrary client‑side code execution, which could lead to data theft or further client‑side attacks; however, there is no evidence of widespread exploitation yet.