YouMind EUVD-2026-98362

Exploitation requires an authenticated YouMind account with access to the avatar update endpoint and its ability to set a profile picture from an arbitrary URL (PR:L). The attacker must supply an SVG file containing embedded JavaScript, which the CDN serves unsanitised with Content-Type: image/svg+xml. Script execution is NOT automatic within the application UI: a victim must navigate directly to the avatar's CDN URL (UI:P), and the code then runs in the CDN domain's context rather than the main YouMind application origin - limiting its reach to that domain's trust boundary. The key limiting factors are the need for an authenticated attacker, required victim interaction (direct navigation), and the cross-domain (CDN) execution context.

This is a low-to-moderate priority issue, consistent with its CVSS 4.0 base score of 5.1 (Medium). The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N indicates network-reachable but constrained exploitation: it requires at least low-level privileges (PR:L - an authenticated YouMind account able to set an avatar) and passive user interaction (UI:P - a victim must navigate directly to the malicious avatar URL), and impact is limited to low confidentiality and low integrity with no availability effect. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no signal of active or probable exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' A notable architectural nuance that the raw score does not capture: the injected script executes in the context of the CDN's domain (image/svg+xml served on direct navigation), not the primary YouMind application origin, which both changes the trust scope and typically limits the attacker's ability to steal main-application session material. There is no conflicting data, but the input is thin: severity and auth characterization rest on the vendor/INCIBE-supplied CVSS 4.0 vector alone, with no corroborating NVD analysis, no affected-version detail, and no confirmed patch.

An authenticated attacker uploads or references an SVG file containing embedded JavaScript as their profile avatar via the avatar update endpoint's arbitrary-URL feature. Because the SVG is served by the CDN with Content-Type: image/svg+xml and without sanitisation, a victim who navigates directly to that avatar URL triggers script execution within the CDN domain's context. No public exploit code was identified at time of analysis.