The vulnerability in Bludit 4.0.0-beta is a stored XSS (CWE-79) that permits an authenticated user with Author privileges to upload a malicious SVG file as the site logo. The SVG file contains embedded JavaScript that is stored and executed in the browsers of users who load the logo, potentially leading to script execution in the context of the affected site. The attack vector is network-based with low attack complexity, requiring user interaction (UI required) and privileges at the Author level. The vulnerability impacts confidentiality and integrity but not availability.

Successful exploitation allows an attacker with Author role privileges to execute arbitrary JavaScript in the context of the affected site for any user who loads the malicious logo. This can lead to information disclosure and manipulation of site content or user sessions. There is no indication of availability impact. The vulnerability does not require high privileges beyond the Author role and can be triggered remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict upload permissions for SVG files or sanitize SVG uploads to remove script tags. Additionally, consider limiting the Author role's ability to upload site logos or implement content security policies to mitigate script execution from SVG files.