CVE-2026-25557 is a reflected cross-site scripting vulnerability in Evoluted PHP Directory Listing Script through version 4.0.5. The vulnerability occurs in index.php where the dir parameter is included in the HTML title element and breadcrumb anchor href attributes without proper HTML encoding. This improper neutralization of input allows attackers to inject malicious JavaScript by manipulating the dir parameter, potentially leading to script execution in users' browsers. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when they visit a crafted URL. This can lead to typical reflected XSS impacts such as session hijacking, defacement, or redirection to malicious sites. However, there is no indication of privilege escalation or direct system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying manual input validation and output encoding for the dir parameter in index.php to prevent script injection. Additionally, employing web application firewalls (WAFs) with XSS filtering rules may help mitigate exploitation attempts.