Omnispace Agora Project versions before 26.10.0 contain a stored cross‑site scripting flaw that permits an authenticated attacker to upload a poll‑response attachment whose filename includes malicious HTML or JavaScript. Because the application’s paramFilter does not sanitize the filename, the value is stored unchanged and later rendered within the dashboard, causing the browser to execute the supplied script when any user visits the affected page. This flaw enables execution of arbitrary client‑side code in the victim’s browser.

The vulnerability affects any deployment of Omnispace Agora Project running a version older than 26.10.0. The flaw is tied to the poll‑response attachment functionality and impacts components that render attachment filenames, such as the dashboard controller.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no confirmed public exploits. Because exploitation requires authenticated access to upload a malicious filename, an attacker must compromise a user account before malicious code can be stored; once stored, the attack vector is limited to users who view the affected page.