A flaw in the html function of PlaylistManager.js permits manipulation of the file_path argument to inject arbitrary HTML. Attackers can trigger this from the network, and the published exploit can execute scripts in the victim's browser. The consequence is that a victim’s session can be hijacked or defaced, enabling further malicious activity.

volotat Anagnorisis versions up to and including 0.4.11 are vulnerable. The flaw resides in the Media Filename Handler component, specifically the html helper that renders file paths into HTML output.

The CVSS score is 5.1, indicating a moderate risk. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is remote and an exploit is publicly available, legitimate users exposed to the vulnerable component should prioritize mitigation. Vulnerability exploitation requires only that a user visit a crafted URL or use the vulnerable function; no local privilege escalation is required.