The flaw permits an attacker to upload an SVG file to the /equipmentFile/upload endpoint of zhitan-ems 1.0.0. When the stored SVG is displayed or processed, malicious script code embedded in the file can run in the victim’s browser. This stored XSS can lead to session hijacking, credential theft, defacement, or other client-side attacks typical of XSS vulnerabilities, indicating insufficient validation or sanitization of uploaded SVG content.

The vulnerability exists in version 1.0.0 of the zhitan-ems management system. No additional product versions are specified, and the vendor is not listed in the CNA data. Administrators should verify whether 1.0.0 is deployed and if the SVG upload capability remains active within their environment.

An attacker can craft a malicious SVG file and submit it through the open upload endpoint. Once the file is accepted, any user who opens or triggers the SVG will be exposed to the injected script. The CVSS score of 6.1 reflects a moderate severity for stored cross-site scripting, while the EPSS score of < 1% indicates a low likelihood of public exploitation. Although the flaw is not listed in CISA’s KEV catalog, the presence of a cross-site scripting vulnerability still requires proactive mitigation.