CVE-2026-108834: Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting
A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file wwpage.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be performed remotely by manipulating the p query parameter handled by ww_page.php. No authentication or privileges are indicated, but exploitation requires user interaction.
Are publicly reachable deployments at greater risk?
Yes. The attack vector is network-based, so instances where ww_page.php is reachable remotely are exposed to attempted exploitation. A public exploit is available, which increases the likelihood of exploitation attempts.
Which versions are known to be affected?
Cairo-dock Glx-Dock versions up to and including 3.4.0 are reported as affected. The available information does not identify a fixed version.
What can be done if patching is not immediately possible?
Restrict remote access to the affected ww_page.php endpoint where operationally feasible, especially for untrusted users. Filtering or blocking requests containing suspicious p parameter values can also reduce exposure.