FOIAXpress CVE-2025-61996

Exploitation requires an actor who already holds administrative access to FOIAXpress in order to edit the Annual Report Template - this is the exact feature carrying the stored payload. The injected content only executes when a separate user performs the specific action of generating an Annual Report (UI:P/required interaction), so there is no self-triggering or fully automatic path. Limiting factors that reduce realistic risk: the mandatory administrative privilege (PR:H), the dependency on a victim generating a report, and the fact that impact is confined to the application's own users rather than the underlying host. Affected deployments are any FOIAXpress instance prior to version 11.13.3.0.

This is a genuine-but-low-priority stored XSS (CWE-79) whose real-world risk is heavily constrained by the privilege model. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L, base 4.8 Medium) requires PR:H - the injecting actor must already be an administrative user - and UI:P, since a separate victim must generate the Annual Report for the payload to fire. All signals point the same low-to-moderate direction and do not conflict: EPSS is 0.24% (14th percentile), indicating very low predicted exploitation probability; there is no CISA KEV listing and no POC referenced in the intelligence; and impacts are rated Low across confidentiality, integrity, and availability with no scope change in the 4.0 metrics. The practical threat model is an insider/compromised-admin scenario rather than a remote unauthenticated takeover - a privileged user weaponizing a template to attack other users of the same application. Net assessment: this is a correctly-scored Medium, not an under-rated critical issue; patch during normal maintenance cycles unless the deploying agency has weak admin-account controls or shared admin roles, which would raise the insider-abuse concern. Note a mild modeling tension worth flagging: the vendor assigned VA:L (availability impact) in the 4.0 vector, which is unusual for a pure session-theft/credential-theft XSS described only as data-oriented - verify with the vendor advisory if availability impact matters to your decision.

A malicious or compromised FOIAXpress administrator edits the Annual Report Template to embed JavaScript. When any other user subsequently generates an Annual Report, the script executes in that victim's authenticated session, allowing the attacker to steal session cookies, user credentials, or sensitive report data. No public exploit code was identified in the provided intelligence, and exploitation requires both pre-existing administrative access (PR:H) and a victim action (UI:P) to trigger.