This vulnerability is a reflected XSS in WebFileSys before version 2.32.0. User-controlled input is reflected without proper output encoding in several components, enabling arbitrary JavaScript execution in a victim's browser. The affected components include ftpBackup functionality, authentication input handling, search functionality, and error message rendering. The CVSS 3.1 base score is 6.1 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, no impact on availability. The issue is fixed in version 2.32.0.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, information disclosure, or other client-side impacts. The vulnerability does not affect system availability and requires user interaction to exploit. There are no known active exploits in the wild.

A fix is available in WebFileSys version 2.32.0. Users and administrators should upgrade to this version to remediate the vulnerability. Since this is a reflected XSS, applying the official patch is the recommended mitigation. Patch status is not explicitly confirmed in vendor advisory content, but the description states the issue is fixed in 2.32.0. No other mitigation guidance is provided.