CVE-2026-51565 is a cross-site scripting (XSS) vulnerability affecting the Milk admin software in the file Modules/Docs/DocsController.php for versions up to 0.9.8. The vulnerability arises from insufficient input sanitization of the 'action' parameter, allowing remote attackers to inject arbitrary scripts or HTML. This can lead to partial confidentiality and integrity impacts via script execution in the context of the affected application. The vulnerability is remotely exploitable without privileges and requires user interaction. No official remediation or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the vulnerable application, potentially leading to partial disclosure of information and modification of data within the user's session. There is no indication of availability impact. The vulnerability requires user interaction and no privileges are needed to exploit it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or sanitization on the 'action' parameter as a temporary mitigation. Monitor vendor communications for updates on patches or official fixes.