Webasyst Framework EUVD-2026-109804

Exploitation requires (1) an authenticated Webasyst backend account that has been granted album edit rights in the Photos app, which the attacker uses to save a malicious 'url' value, and (2) a victim administrator subsequently opening the affected album's DialogAlbumSettings dialog, where the value is emitted into an unescaped HTML attribute (the required victim interaction reflected as UI:P). The payload must break out of that attribute context to execute. Limiting factors: this is not remote-unauthenticated - it needs a privileged-enough backend user to reach album editing (PR:L), it depends on admin interaction to fire (so it cannot self-trigger), and no fixed version is provided in the available data. These constraints confine realistic risk to deployments that delegate album-editing to semi-trusted users.

This is a genuine but second-tier issue, consistent with its CVSS 4.0 base score of 5.1 (medium). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) shows the realistic constraints clearly: it is network-reachable and low-complexity, but it requires an already-authenticated backend account (PR:L) that holds album edit rights, and it requires a victim administrator to interact with the malicious album settings (UI:P). Impact is bounded - VC:L/VI:L/VA:N with low subsequent-system impact (SC:L/SI:L) - reflecting a stored XSS that runs in an admin's browser session rather than granting direct server compromise. No EPSS score and no CISA KEV entry are present in the input, so there is no signal of active or probabilistic widespread exploitation; the vuln.today decision label is 'this_month', i.e. a scheduled-remediation priority rather than act_now/emergency. No public exploit identified at time of analysis - the references are a vendor bug report, the specific vulnerable source lines, and a VulnCheck advisory, none of which is verified working exploit code. Net: a real, prioritizable privilege-abuse XSS for environments that grant Photos-app album editing to semi-trusted backend users, but not an internet-wide unauthenticated emergency. The combination of required privileges and required admin interaction points to targeted insider/privilege-escalation abuse rather than mass exploitation.

A lower-privileged backend user who has been granted album edit rights in the Webasyst Photos app saves an album 'url' value crafted to break out of the unescaped HTML attribute in DialogAlbumSettings.html. When a higher-privileged administrator later opens that album's settings dialog, the injected JavaScript executes in the administrator's authenticated backend session, enabling actions such as session/token theft or performing admin operations as that user. No verified public exploit code exists, though the vulnerable template and controller lines are publicly referenced.