VitaFit Cloud API CVE-2026-54380

Exploitation requires: (1) an authenticated VitaFit cloud API account (PR:L) with the ability to upload files to the shared storage bucket; (2) the application serving image/svg+xml without sanitizing embedded scripts and without forcing a download (Content-Disposition), which is the specific defect described; and (3) a victim who directly navigates in a browser to the uploaded SVG's URL (UI:P). Limiting factors: the attacker must already have valid credentials, the payload only runs on direct browser navigation rather than inline rendering, and impact is confined to the victim's browser session (no confidentiality/integrity/availability impact to the server itself per VC:N/VI:N/VA:N). The shared storage bucket is what makes this reach other users rather than only the uploader.

This is a medium-severity stored XSS (CWE-79) with modest real-world priority, not a drop-everything issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/SC:L/SI:L, score 5.1) is internally consistent with the description: network-reachable cloud API, low attacker privileges (PR:L = an authenticated account is required), and passive victim interaction (UI:P, the victim must open the malicious SVG). Notably the vulnerable-system impacts are all None (VC:N/VI:N/VA:N) while the impact lands on the subsequent system (SC:L/SI:L) - i.e. the victim's browser session, which is the correct modeling for reflected/stored script execution in a shared-bucket context. The vuln.today decision label is 'this_month' (routine remediation), not act_now/emergency. The vulnerability is NOT in CISA KEV and no EPSS score was supplied, so there is no signal of active or probable exploitation. A PoC reference exists (a security-research GitHub repo) but it is a reference only and is not verified as working exploit code. Net: the signals are mutually consistent and point to a genuine but bounded web-app flaw whose exploitation requires an authenticated foothold plus victim action - real to fix, but not an emergency.

An attacker who holds a valid (low-privilege) VitaFit account uploads an SVG file containing embedded JavaScript to the shared storage bucket the cloud API serves. Because the application does not sanitize image/svg+xml content or force it to download, the script executes in the browser of any victim who navigates directly to the file's URL. A public PoC reference exists but is not verified as working exploit code, and the flaw is network-reachable with low attack complexity but depends on the victim opening the file (UI:P).