CVE-2025-26897 describes a DOM-based cross-site scripting vulnerability in the Baden List Related Attachments widget (versions <= 2.1.6). The issue arises from improper neutralization of input during web page generation, enabling an attacker to inject and execute malicious scripts in the victim's browser. The vulnerability requires network access, low attack complexity, some privileges, and user interaction. The scope is changed, affecting confidentiality, integrity, and availability at a low level. No known exploits are reported in the wild, and no patch or vendor advisory is currently provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim user, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium severity with low-level confidentiality, integrity, and availability impacts. Exploitation requires user interaction and some privileges, reducing the likelihood of widespread impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure by restricting access to the affected component and exercising caution with user-supplied input. Monitor vendor channels for updates and apply patches promptly once released.