The vulnerability CVE-2025-48109 affects Xavier Media's XM-Backup product through version 0.9.1. It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but user interaction is needed. The vulnerability impacts confidentiality, integrity, and availability at a low level. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to trick an authenticated user into executing unwanted actions on the XM-Backup application, potentially resulting in stored XSS. This can lead to unauthorized script execution in the context of the victim's browser, impacting confidentiality and integrity of user data and possibly availability of the service. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens and restricting actions to trusted users. Monitoring for unusual activity related to stored XSS may also help detect exploitation attempts.