A stored cross-site scripting vulnerability in the Homarr dashboard allows authenticated attackers to potentially gain administrative control over the application.

The application fails to properly validate uploaded file types, specifically allowing malicious SVG files to be stored and rendered. This permits the execution of arbitrary JavaScript in the browser of a victim, such as an administrator, which can be leveraged to modify account credentials or escalate privileges.

Successful exploitation of this vulnerability poses a severe risk to organizational security, as it facilitates privilege escalation to the administrative level. By compromising an administrative account, an attacker could gain full control over the dashboard, leading to unauthorized data access, system configuration changes, or further lateral movement within the network. The CVSS score of 8.1 reflects the high potential for impact on confidentiality and integrity.

Immediate Action: Update Homarr to version 1.43.3 or later to apply the necessary input validation and file upload restrictions.

Proactive Monitoring: Review web server access logs for unusual SVG file upload patterns and audit the "credentials-admin" group for unauthorized additions.

Compensating Controls: Implement strict file upload policies on the web server or configure a Web Application Firewall to block SVG uploads or inspect them for embedded scripts.

Public Exploit Available: Unknown

Given the potential for complete administrative takeover, this vulnerability must be treated with high priority. Administrators should ensure that all instances of Homarr are patched to version 1.43.3 immediately. Failure to remediate could allow an attacker to gain persistent, unauthorized administrative access to the platform.