CVE-2026-5220 describes a stored cross-site scripting (XSS) vulnerability in DivvyDrive Information Technologies Inc.'s DivvyDrive product. The vulnerability arises from improper neutralization of input during web page generation, classified under CWE-79. It affects version 4.8.2.23 specifically, allowing an attacker with low privileges and no user interaction to execute scripts in the security context of the victim user. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to unauthorized disclosure or modification of data accessible to the victim user. The impact is limited to confidentiality and integrity, with no direct impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented in the provided data. Users of DivvyDrive version 4.8.2.23 should monitor vendor communications for updates and apply patches once available. Until then, consider restricting access to the affected version and applying web application firewall rules to detect and block XSS payloads if feasible.