CVE-2021-41372

CVE-2021-41372 is a critical Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability affecting Microsoft Power BI Report Server. It allows an unauthenticated attacker to upload malicious Power BI template files containing HTML, which, when accessed by a victim, can lead to script execution in the user's security context and potential privilege escalation if the victim has administrative rights. With a CVSS score of 9.6 (Critical), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the CISA KEV catalog, though it has received some community discussion and media coverage.