The vulnerability identified as CVE-2025-48291 affects the Contest Gallery software by Wasiliy Strecker. It is a Stored Cross-site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that persist on the affected application and execute in the context of other users' browsers. The vulnerability affects versions up to 26.0.6. The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated as low to low to low respectively. No patch or vendor advisory information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting the affected Contest Gallery application. This can lead to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of user data and application functionality. The CVSS score of 7.1 reflects a high severity level with potential for significant impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding controls at the application level to mitigate stored XSS risks. Monitor vendor channels for updates and apply patches promptly once released.