A critical Stored Cross-Site Scripting vulnerability in Morelitea Initiative allows authenticated users to execute arbitrary JavaScript, potentially leading to session hijacking or sensitive data theft.

The application fails to properly sanitize or restrict file types during document uploads, allowing users with upload permissions to host malicious HTML files directly on the application origin. This enables the execution of unauthorized scripts in the context of other users, including administrators, when they access the uploaded content.

Successful exploitation of this flaw poses a severe risk to organizational security, as it facilitates the theft of session cookies and authentication tokens. Given the CVSS score of 8.7, this vulnerability is classified as High severity, as it can lead to full account takeover and unauthorized access to sensitive project management data. The ability to exfiltrate session data undermines the integrity of the entire application environment.

Immediate Action: Update the Morelitea Initiative platform to version 0.32.4 or later immediately to resolve the upload validation flaw.

Proactive Monitoring: Review web server and application access logs for unusual requests directed toward the document upload directory or suspicious file extensions.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict script execution and utilize a Web Application Firewall (WAF) to block uploads of suspicious file types like .html or .htm.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk for any organization utilizing the Initiative platform for sensitive project management. Administrators must prioritize the upgrade to version 0.32.4 to eliminate the underlying file upload and XSS vectors. Until the patch is applied, restrict document upload permissions to the minimum number of trusted users to reduce the attack surface.