This vulnerability (CVE-2024-11404) affects django Filer versions prior to 3.3 and is characterized by unrestricted file upload of dangerous types combined with improper sanitization of script-related HTML tags. This leads to stored cross-site scripting (XSS) attacks, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-80 (Improper Neutralization of Script-Related HTML Tags). The CVSS 3.1 base score is 5.5 (medium), reflecting network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability at a low level. The vulnerability allows an attacker with some privileges to upload malicious files that can execute scripts in the context of the web application.

Successful exploitation can result in stored XSS, enabling attackers to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or other malicious actions. The CVSS vector indicates limited confidentiality, integrity, and availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the django CMS Association advisories for updates. Until a fix is available, restrict file upload permissions to trusted users and implement additional validation or filtering on uploaded files to mitigate risk.