A stored cross-site scripting flaw in Cal.com Self-Hosted (Cal.diy) allows authenticated attackers to execute arbitrary code, posing a significant risk to user session integrity.

The application is susceptible to stored cross-site scripting (CWE-79) due to improper neutralization of input within the booking page tag manager analytics tracking ID. This requires an authenticated user with low-level privileges to inject malicious payloads.

Successful exploitation allows an attacker to inject scripts that execute in the context of other users, including administrators. This can lead to unauthorized access to sensitive booking data, session hijacking, or defacement of the platform. With a CVSS score of 8.9, the potential for high impact on data confidentiality and integrity makes this a critical security concern for organizations relying on this software for scheduling.

Immediate Action: Update Cal.com Self-Hosted instances to a version beyond 6.2.0 as provided by the vendor.

Proactive Monitoring: Review web application logs for suspicious entries in the analytics tracking ID field and monitor for unusual client-side script execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common cross-site scripting patterns in input parameters.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

The presence of a public proof-of-concept increases the urgency of this advisory. Administrators should prioritize patching their self-hosted instances immediately to prevent potential account takeover and unauthorized data access.