A Cross‑Site Scripting vulnerability exists in the YouMind web application’s avatar update endpoint. When a user sets a profile picture via an arbitrary URL, the application accepts an SVG file that contains embedded JavaScript. The SVG is served by the CDN with a Content‑Type of image/svg+xml and, when accessed directly, the script runs inside the context of the CDN’s domain. The lack of sanitisation and validation allows the attacker to inject client‑side code. This can lead to execution of arbitrary scripts, potentially compromising the CDN environment or stashing credentials that belong to the user or the CDN service if cross‑domain cookies are present.

The affected system is the YouMind web application, specifically the avatar update functionality exposed via the CDN. No specific version information is available for the application or the CDN configuration.

The CVSS score of 5.1 indicates a moderate severity for this XSS flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be user‑controlled input through the avatar upload endpoint; an attacker can craft a malicious SVG and have the CDN serve it to victims. Exploitation does not require privileged access and may be accomplished in a single step by simply uploading or linking to a malicious image. The impact is limited to client‑side code execution, but XSS can be used to steal sensitive data, deface the site, or perform phishing attacks.