The vulnerability identified as CVE-2026-75307 affects zhitan-ems version 1.0.0. It is a Cross Site Scripting (XSS) flaw that occurs when the application processes SVG file uploads via the /equipmentFile/upload endpoint. Malicious SVG files can contain embedded scripts that execute in the context of the affected application, potentially leading to script injection attacks. No CVSS score or detailed vendor advisory is available, and no remediation level or patch information has been provided.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the user's browser session when interacting with the vulnerable endpoint. This may lead to session hijacking, defacement, or other script-based attacks depending on the application's context. However, there is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting or sanitizing SVG file uploads or disabling SVG uploads if possible as a temporary mitigation.