FileRise exposes an unauthenticated public configuration API that returns the raw admin‑provided footerHtml field without server‑side sanitization. Because the frontend sanitizes the value only during client rendering, the opportunity exists for an attacker to store malicious HTML or JavaScript in that field and have it returned unchanged to any client that consumes the API. If the client subsequently renders the content, the malicious code will execute, allowing cross‑site scripting or similar injection attacks against users who request the configuration. The vulnerability stems from improper input validation (CWE‑79) and represents a client‑side execution risk rather than an immediate server compromise.

The vulnerability affects all FileRise installations running a version older than 3.21.0. Devices or servers that have not applied the published 3.21.0 update or later are susceptible. No specific sub‑versions are excluded beyond the stated cutoff.

The CVSS score of 4.8 indicates moderate severity. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, suggesting the vulnerability has not yet been widely exploited. The primary attack vector is an unauthenticated HTTP request to the public site configuration API; however, the attacker first needs administrative access to store a malicious footerHtml value. Once stored, anyone can retrieve it, potentially leading to widespread exposure if clients render the data. Because the flaw requires prior administrative credential use, the risk is moderate but non‑negligible, especially for environments that endpoint to external users or integrate it with third‑party clients.