The vulnerability CVE-2025-26766 affects VaultDweller Leyka through version 3.31.8 and involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). This flaw allows attackers with some level of privileges to inject malicious scripts that are stored and later executed in the context of other users' browsers. The CVSS vector indicates the attack can be performed remotely with low complexity, requires low privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to session hijacking, defacement, or other malicious actions impacting confidentiality, integrity, and availability. The impact is rated medium based on the CVSS score of 6.5. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patches or fixes have been provided at this time. Users should monitor VaultDweller's advisories for updates. Until a fix is available, consider restricting user input or applying web application firewall (WAF) rules to detect and block malicious scripts if feasible.