CVE-2026-108498: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in bannersky BSK PDF Manager

The vulnerability CVE-2026-108498 in bannersky BSK PDF Manager (versions up to 3.8.1) is a stored cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that persist and execute when other users access the affected pages, potentially leading to confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Successful exploitation of this stored XSS vulnerability can lead to partial confidentiality, integrity, and availability impacts. Attackers may execute arbitrary scripts in the context of other users, potentially stealing sensitive information, manipulating content, or causing denial of service conditions. The vulnerability affects remote attackers with no privileges and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation and output encoding controls as temporary mitigations to reduce the risk of stored XSS. Monitor vendor channels for updates and apply patches promptly once released.