CVE-2026-108834: Cross Site Scripting in Cairo-dock Glx-Dock

The vulnerability CVE-2026-108834 affects Cairo-dock Glx-Dock versions 3.0 through 3.4.0. It is caused by insufficient sanitization or validation of the 'p' parameter in the ww_page.php file within the Query Parameter Handler component. This flaw enables remote attackers to perform cross-site scripting attacks by injecting malicious scripts via the manipulated 'p' argument. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vendor was contacted but did not provide a response or patch. Exploit code is publicly available, but no known exploitation in the wild has been reported.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires user interaction and does not escalate privileges or compromise the server directly. The medium CVSS score reflects these factors.

No official patch or remediation is currently available from the vendor, who has not responded to disclosure attempts. Users should apply general XSS mitigations such as input validation and output encoding if possible. Monitor vendor channels for updates and consider restricting access to the vulnerable component until a fix is released. Since exploit code is public, heightened vigilance is recommended.