Omnispace Agora Project before version 26.10.0 contains a stored cross‑site scripting flaw that lets an attacker inject malicious JavaScript by uploading a file whose name includes hostile markup. The filename is stored without sanitisation and later rendered to other users who view the file, which causes the embedded script to execute in their browsers. This is a classic stored XSS vulnerability (CWE‑79) that can enable session hijacking, data theft or defacement of the application.

The vulnerability affects Omnispace Agora Project instances running any version older than 26.10.0. Users and administrators should verify the version of the software they are operating to determine risk exposure.

The CVSS base score of 5.1 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to upload files, but once a maliciously named file is stored, any user who later views the file is exposed to script execution. The attack vector is therefore an authenticated file‑upload activity that leads to cross‑site scripting for downstream users.