The vulnerability (CVE-2026-72583) in fastschema up to version 0.15.1 is a stored XSS issue where an attacker with low privileges and authentication can upload an SVG file embedding malicious JavaScript. This bypasses the MIME type allow-list intended to prevent such uploads. The flaw is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 3.1 base score is 5.4 (medium severity) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and limited confidentiality and integrity impact.

Successful exploitation allows an attacker to execute malicious JavaScript in the context of the vulnerable application, potentially leading to partial disclosure of sensitive information and modification of data within the affected scope. Availability is not impacted. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or monitor SVG file uploads and consider additional validation or sanitization of uploaded SVG content to prevent malicious script execution.