Vulnerability · Published Oct 12, 2026 · Assigned by VulDB
CVE-2026-108834Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting
Medium 4.3
In plain English
A medium-severity cross-site scripting in Glx-Dock from Cairo-dock. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | cairo-dock | no fix listed | UBUNTU-CVE-2026-108834 |
| Ubuntu:24.04:LTS | cairo-dock | no fix listed | UBUNTU-CVE-2026-108834 |
| Ubuntu:26.04:LTS | cairo-dock | no fix listed | UBUNTU-CVE-2026-108834 |
| Ubuntu:26.10 | cairo-dock | no fix listed | UBUNTU-CVE-2026-108834 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cairo-dock | Glx-Dock | 3.03.13.23.33.4.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
References
- VDB-416608 | Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting vdb-entry, technical-description
- VDB-416608 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-108834 | CVE Analysis and Report third-party-advisory
- Submit #971713 | Cairo-dock Glx-Dock 3.4.0 Cross Site Scripting third-party-advisory