CVE-2026-25557 is a reflected cross-site scripting vulnerability in Evoluted PHP Directory Listing Script through version 4.0.5. The vulnerability arises because the dir parameter value is included in the HTML title element and breadcrumb anchor href attributes without proper HTML encoding or neutralization. This improper input handling enables attackers to inject malicious JavaScript by breaking out of the title context or by injecting event handlers into breadcrumb anchors, leading to script execution in users' browsers. The vulnerability has a CVSS 4.0 score of 5.1, reflecting a medium impact with network attack vector, low attack complexity, no privileges required, user interaction needed, and low scope impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when they visit a crafted URL. This can lead to typical reflected XSS impacts such as session hijacking, defacement, or redirecting users to malicious sites. However, the attack requires user interaction (clicking a crafted link) and does not escalate privileges or affect system confidentiality, integrity, or availability beyond the browser context.

No official fix or patch is currently available for this vulnerability. Users and administrators should monitor the vendor's advisory for updates. As a temporary mitigation, avoid exposing the vulnerable parameter in URLs or implement manual input validation and HTML encoding for the dir parameter in index.php if possible. Since this is a reflected XSS, educating users to avoid clicking suspicious links can reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.