A stored cross-site scripting issue exists in Knowledge Base articles. Users with permissions to create or edit articles can attach a JavaScript file and insert a crafted link into the article body. If an administrator clicks this link, the script executes within their session, potentially allowing the creation of a new administrator account with credentials specified by the attacker.