CVE-2026-34812 is a stored cross-site scripting vulnerability (CWE-79) affecting Endian Firewall version 3.3.25 and prior. The issue arises from improper neutralization of input in the mimetypes parameter of the /cgi-bin/proxypolicy.cgi endpoint. An attacker with authenticated access can inject arbitrary JavaScript code that is persistently stored and executed in the context of other users viewing the affected page, potentially leading to session hijacking or other client-side attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, and user interaction is required.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who view the affected page, which may lead to theft of session tokens, defacement, or other client-side impacts. The vulnerability does not require elevated privileges beyond authentication and has a medium severity rating (CVSS 5.1). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to the affected endpoint and consider applying web application firewall rules to detect and block suspicious input in the mimetypes parameter. Monitor vendor communications for updates on patches or official mitigations.