Stored XSS via unchecked disposition parameter

Stored XSS in Scilico's Librarian application before 5.11.2 allows remote authenticated users to execute JavaScript through a supplemental file. The supplements.php downloadAction accepts an arbitrary disposition query value and applies the MIME allowlist only when that value is inline, so another value bypasses the check. Exploitation requires low-privileged upload access and a user to load the file; the script then runs in the application context and can access or alter data available to that user.