CVE-2026-5615 is a cross-site scripting vulnerability in the file upload.php endpoint of givanz Vvvebjs (up to version 2.0.5). The vulnerability is triggered by manipulation of the uploadAllowExtensions argument, which is not properly sanitized, enabling remote attackers to inject and execute malicious scripts. The vendor responded promptly and released a fixed version to remediate the issue. The vulnerability has a CVSS 4.0 score of 5.3, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation allows remote attackers to perform cross-site scripting attacks, potentially leading to script execution in the context of the victim's browser. This can result in session hijacking, defacement, or other client-side impacts. The vulnerability does not require privileges or authentication but does require user interaction. There are no known exploits in the wild at this time.

A patch has been released by the vendor to fix this vulnerability. Applying the vendor's fixed version of givanz Vvvebjs is the recommended action to remediate this issue. Since the vendor has provided an official fix, upgrading to the patched version should be prioritized.