MiniGal Nano versions up to 0.3.5 are affected by a reflected XSS vulnerability (CWE-79) in index.php via the dir parameter. The vulnerability arises because the application constructs the $currentdir variable from user-controlled input and embeds it directly into an error message without proper output encoding or sanitization. This allows an attacker to inject arbitrary HTML or JavaScript code that is reflected in the server's response, potentially enabling script execution in the victim's browser within the context of the vulnerable application. The CVSS 4.0 base score is 5.1, indicating medium severity. There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser when visiting a crafted URL containing malicious input in the dir parameter. This can lead to session hijacking, defacement, or other client-side attacks within the context of the MiniGal Nano application. The vulnerability does not require privileges or user interaction beyond visiting the malicious link, but user interaction is required to trigger the reflected XSS. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying manual output encoding or input validation on the dir parameter to prevent injection of malicious code. Avoid using untrusted input directly in error messages or HTML output. Monitor vendor channels for updates regarding an official patch or fix.