Fastschema contains a stored XSS flaw that permits a low‑privileged authenticated user to upload an SVG file that bypasses the MIME type allow‑list check. The malicious SVG is stored in the application’s web root and is rendered by browsers when the corresponding page is viewed, yielding arbitrary client‑side code execution within the context of users who access that page. Based on the description, it can be inferred that such execution may compromise the confidentiality and integrity of data accessed during that session.

The flaw affects all installations of fastschema prior to v0.15.2, specifically those that expose the rclonefs base PutMultipart API. The product is maintained by the fastschema community and can be found at https://github.com/fastschema/fastschema.

The CVSS score of 5.4 indicates a medium‑severity vulnerability. No EPSS score is currently available, and the issue is not listed in CISA’s KEV catalog. An attacker must be authenticated to the application and has low privileges, but can reach the file‑upload endpoint. After the SVG file is stored, any user who views the resulting page is subject to the client‑side code execution. The attack requires only legitimate authentication and the ability to upload a file, but no further escalated privileges.