This vulnerability (CVE-2026-5784) in DivvyDrive is caused by improper input sanitization leading to stored cross-site scripting (CWE-79). It affects versions 4.8.2.9 up to but not including 4.8.3.2. An attacker can inject malicious scripts that persist on the server and execute in the context of other users' browsers, potentially compromising user data and system integrity. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the system and user data. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider applying temporary mitigations such as input validation and output encoding on affected inputs if possible. Avoid exposing vulnerable versions in untrusted environments.