CVE-2025-27361 describes a reflected cross-site scripting (XSS) vulnerability in thhake Photo Express for Google, affecting versions up to 0.3.2. The issue arises from improper input sanitization during web page generation, enabling attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in users' browsers, potentially leading to data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of user data. However, there are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available for this vulnerability. Users and administrators should monitor the vendor's communications for updates and apply any future patches promptly. Until a fix is released, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts if feasible.