The vulnerability CVE-2025-26868 in fastflow Fast Flow fast-flow-dashboard is a reflected cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. It affects all versions through 1.2.16. Exploitation requires user interaction and can result in the execution of arbitrary scripts in the victim's browser, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The CVSS score of 7.1 reflects these impacts as partial confidentiality, integrity, and availability losses. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts if feasible.