CVE-2026-38936 is a reflected XSS vulnerability affecting diskover-community software versions up to 2.3.5. The vulnerability arises from insufficient input sanitization of the 'namecontains' parameter in the public/selectindices.php endpoint, which can be exploited to execute arbitrary scripts in the victim's browser. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the affected user's browser, potentially leading to information disclosure or manipulation of user interactions. The vulnerability does not affect system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should exercise caution when interacting with untrusted input in the affected parameter. Consider applying web application firewall (WAF) rules to detect and block malicious input targeting the 'namecontains' parameter.