The vulnerability arises from improper neutralization of input during web page generation, specifically through the file upload endpoint. Attackers can upload HTML files containing XSS payloads, which are then stored on the server. When a victim accesses the file via a provided link, the malicious script is executed in their browser, potentially leading to session hijacking or data theft.

An attacker uploads a file named 'xss.html' containing a malicious script to the server. They then share the link to this file with a victim. When the victim opens the link, the script executes in their browser, potentially stealing session cookies or other sensitive information and sending it to the attacker's server.

Users of version 3.83 of the software who access shared file links are affected. This includes any user who can be tricked into clicking on a malicious link.