A Stored Cross-Site Scripting vulnerability in the File Browser EPUB preview function allows authenticated attackers to execute malicious scripts within a victim's session.

This vulnerability is a Stored Cross-Site Scripting (CWE-79) flaw located in the EPUB preview functionality. An attacker with low privileges can upload a crafted EPUB file containing malicious JavaScript, which executes when an unsuspecting user previews the file.

The exploitation of this vulnerability allows for unauthorized script execution within the context of an authenticated user's session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive information, resulting in significant security compromises within the file management interface. The CVSS score of 7.6 reflects a high severity due to the potential for impact on confidentiality and integrity.

Immediate Action: Upgrade File Browser to version 2.62.2 or later to apply the security patch.

Proactive Monitoring: Review access logs for unusual file upload activity or unexpected interactions with the EPUB preview feature.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall to filter malicious file uploads.

Public Exploit Available: No (Exploit available: unknown)

Given the potential for session compromise and the availability of a patch, administrators should prioritize updating to version 2.62.2 immediately. This update effectively neutralizes the XSS vector and secures the EPUB preview mechanism against malicious input.