Fastschema contains a stored XSS flaw that allows an attacker to inject malicious JavaScript into the application’s web root. The vulnerability originates from the PutMultipart function validating only the MIME type header it receives rather than the file’s true content. By providing a file named with an image extension but holding SVG data marked image/svg+xml, a low‑privileged authenticated user can upload a script‑laden SVG. Once stored, the script is executed in the browsers of users who view the affected page, enabling session hijacking, cookie theft, and defacement. This flaw maps to CWE‑79.

The flaw affects all installations of fastschema prior to v0.15.2, specifically those that expose the rclonefs base PutMultipart API. The product is maintained by the fastschema team and can be found at https://github.com/fastschema/fastschema.

The CVSS score of 5.4 indicates a medium severity flaw. No EPSS score is currently available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated to the application, but a low‑privileged user can reach the upload endpoint. Once the malicious SVG file is stored, any user who views the resulting page will be affected. The attack vector is thus user‑initiated file upload, and the vulnerability can be exploited without additional access privileges beyond authentication.