CVE-2026-109895: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Arraytics Booktics

The vulnerability CVE-2026-109895 in Arraytics Booktics is a DOM-based Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows attackers to inject and execute malicious scripts in the context of the affected web application. The affected versions include all releases from the initial version up to 1.0.29. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. There is no information about an official patch or vendor advisory, and no known exploitation in the wild has been reported.

Successful exploitation of this DOM-based XSS vulnerability can allow attackers to execute arbitrary scripts in the victim's browser context, potentially leading to partial loss of confidentiality, integrity, and availability of the affected system or user data. This could enable actions such as session hijacking, defacement, or other malicious activities within the scope of the affected web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor communications for updates on patches or official mitigations.