This vulnerability in OpenAkita up to version 1.27.12 allows remote attackers to perform cross-site scripting via the File argument in the /api/upload endpoint of the File Upload API. The attack complexity is high, requiring user interaction, and no privileges or authentication are needed. Although exploit code is publicly available, the difficulty of exploitation reduces the risk. The vendor has not responded to disclosure and no remediation information is provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the vulnerable endpoint, potentially leading to session hijacking or other client-side impacts. However, the low CVSS score and high attack complexity indicate limited impact and exploitation difficulty.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying additional input validation or filtering on the File parameter as a temporary mitigation and monitor for updates from the vendor.