OpenAkita up to version 1.27.12 contains a cross-site scripting vulnerability in the /api/upload endpoint of its File Upload API component. The vulnerability arises from improper handling of the File argument, allowing an attacker to inject malicious scripts. The attack can be performed remotely but requires high complexity and user interaction, with no privileges needed. Although an exploit is publicly available, the vendor has not issued any response or patch. The CVSS 4.0 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, and low impact on integrity and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the vulnerable endpoint. This may lead to session hijacking, defacement, or other client-side impacts. However, the overall impact is rated low due to the high complexity of the attack and required user interaction, and limited integrity and availability impact.

No official fix or patch is currently available for this vulnerability. Since the vendor has not responded or provided remediation, users should consider implementing web application firewalls or input validation controls to mitigate potential exploitation. Monitor for updates from the vendor for any future patches or advisories. Avoid exposing the vulnerable endpoint to untrusted users if possible.