CVE-2025-50848 describes a file upload vulnerability in CS Cart 4.18.3 where unrestricted upload of HTML files is permitted. Uploaded malicious HTML files are served from the trusted domain and rendered in browsers, facilitating phishing attacks via fake login forms or XSS attacks. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. There is no known exploit in the wild and no vendor patch or advisory currently available.

An attacker can upload crafted HTML files that execute in the context of the trusted domain, enabling phishing attacks and Cross-Site Scripting (XSS). This can lead to credential theft and unauthorized script execution affecting users interacting with the site. The vulnerability impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable file uploads of HTML content and implement server-side validation to block malicious file types. Consider applying web application firewall (WAF) rules to detect and block suspicious uploads or payloads.