OPEXUS FOIAXpress CVE-2025-61997

Exploitation requires an authenticated account with administrative privileges (PR:H) that has access to the Annual Report Enterprise Banner image upload field - this is the exact feature that fails to sanitize uploaded content. The payload does not execute at upload time; it fires only when a separate victim user performs the specific action of generating an Annual Report (UI:P/passive interaction), so exploitation depends on a second user exercising that reporting workflow. Limiting factors: the high administrative privilege barrier to plant the payload, the dependence on victim-initiated report generation, and the requirement that the target FOIAXpress instance be at a version before 11.13.3.0. These conditions make opportunistic or mass exploitation impractical; it is realistically an insider-abuse or post-admin-compromise scenario.

This is a genuinely low-to-moderate priority issue despite being a stored XSS, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) scores 4.8 (Medium), and the key limiting factor is PR:H - exploitation requires an already-authenticated ADMINISTRATIVE user to plant the payload, so this is a privileged-insider / post-compromise escalation vector, not a path for an external unauthenticated attacker. UI:P confirms a second condition: a victim must independently generate an Annual Report for the payload to fire. EPSS reinforces low real-world risk at 0.24% (14th percentile). There is no CISA KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis.' Impact is bounded (VC:L/VI:L/VA:L, SC:N) - it does not grant system compromise, only limited action-on-behalf-of a victim within the application. The main nuance to verify: the attack vector is rated AV:N, but because the attacker must be a logged-in admin of the FOIAXpress instance, the practical exposure is far narrower than 'network' implies - treat this as an authenticated stored-XSS with a high privilege barrier, not an internet-facing critical.

A malicious or compromised FOIAXpress administrator uploads a crafted file to the Annual Report Enterprise Banner image upload field containing injected JavaScript instead of a legitimate image. When another user (e.g., a less-privileged staffer or reviewer) later generates an Annual Report, the stored script executes in their authenticated browser session, letting the attacker exfiltrate the victim's session cookies, credentials, or sensitive FOIA data. No public proof-of-concept exploit is referenced in the available data.