The vulnerability allows an attacker to upload a malicious HTML file containing JavaScript code. When a user accesses the uploaded file, the malicious script is executed in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious activities.

An attacker uploads a malicious HTML file containing JavaScript code to the application. When another user accesses the uploaded file via a provided URL, the malicious script executes in the user's browser, allowing the attacker to perform actions such as stealing cookies, session tokens, or other sensitive information.

Users of the latest version of the software who access files uploaded by other users are affected by this vulnerability.