PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108834 Cairo-dock CVE debrief

A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. Defenders should assess exposure and prioritize verification and mitigation efforts for systems using Glx-Dock versions up to 3.4.0. The vulnerability allows for remote cross-site scripting attacks, impacting defenders who must verify Glx-Dock versions and configurations. Remediation priority is moderate due to public exploit availability.

Vendor
Cairo-dock
Product
Glx-Dock
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for systems using Glx-Dock versions up to 3.4.0 should assess exposure and prioritize verification and mitigation efforts. Defenders should care about CVE-2026-108834 because it affects Glx-Dock up to version 3.4.0, allowing for remote cross-site scripting attacks. Exposure verification and mitigation are crucial for operators, platforms, vulnerability management, and security teams.

Why it matters

Defenders should care about CVE-2026-108834 because it affects Glx-Dock up to version 3.4.0, allowing for remote cross-site scripting attacks. Exposure verification and mitigation are crucial.

  • Cross-site scripting attacks may be possible
  • Defenders must verify Glx-Dock versions and configurations
  • Remediation priority is moderate due to public exploit availability

Technical summary

The vulnerability affects Cairo-dock Glx-Dock up to version 3.4.0, specifically in the ww_page.php file of the Query Parameter Handler. An attacker can manipulate the argument 'p' to perform cross-site scripting attacks remotely. This issue allows for remote cross-site scripting attacks, impacting defenders who must verify Glx-Dock versions and configurations. The exploit is public, and exposure verification and mitigation are crucial. Defenders should prioritize verifying exposure of Glx-Dock versions up to 3.4.0 and assessing the feasibility of cross-site scripting attacks.

Defensive priority

Defenders should prioritize verifying exposure of Glx-Dock versions up to 3.4.0 and assessing the feasibility of cross-site scripting attacks.

Recommended defensive actions

  • Verify Glx-Dock versions up to 3.4.0 are not in use or properly mitigated
  • Assess the feasibility of cross-site scripting attacks
  • Monitor for potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but vendor comments or additional impact information are not available. Defenders should verify Glx-Dock versions up to 3.4.0 and assess the feasibility of cross-site scripting attacks. The exploit is public, and exposure verification and mitigation are crucial. No additional information is available from the vendor.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108834 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108834

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108834 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108834

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108834.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416608

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416608/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-108834

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/971713

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.