EUVD-2026-28360
GHSA-pmh8-hhp9-qxxf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross-Site Scripting (XSS).
This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2.
AnalysisAI
Cross-site scripting (XSS) in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers, leading to session hijacking, credential theft, and malicious actions performed under victim's identity. The CVSS score of 8.8 (High) reflects the broad impact scope (confidentiality, integrity, availability all rated High), though user interaction is required. TR-CERT disclosure indicates awareness within Turkish government cybersecurity circles, but no CISA KEV listing or public exploit code identified at time of analysis, suggesting limited active exploitation outside potential targeted campaigns.
Technical ContextAI
This is a classic stored or reflected XSS vulnerability (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page) in DivvyDrive, a file sharing and collaboration platform by DivvyDrive Information Technologies Inc. The vulnerability stems from inadequate input sanitization or output encoding of user-controlled data before rendering it in HTML contexts. Attackers can inject malicious <script> tags or event handlers that execute JavaScript when other users view the affected page. The CPE string identifies the affected software as DivvyDrive from vendor DivvyDrive Information Technologies Inc., with version specificity indicating versions 4.8.2.9 through 4.8.3.1 are vulnerable. The CVSS vector (AV:N/AC:L) indicates network-based exploitation with low complexity, requiring no special deployment conditions beyond standard web access.
RemediationAI
Upgrade DivvyDrive to version 4.8.3.2 or later, which addresses the XSS vulnerability according to the version range specified in NVD data. Refer to TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0182) for vendor-specific upgrade instructions and release notes. If immediate patching is not feasible, implement compensating controls: deploy Web Application Firewall (WAF) rules to detect and block common XSS payloads in HTTP requests and responses targeting DivvyDrive endpoints (note: this may produce false positives with legitimate file names containing special characters, requiring tuning); enable Content Security Policy (CSP) headers to restrict inline script execution, though this requires testing to ensure compatibility with DivvyDrive's legitimate JavaScript functionality; and restrict DivvyDrive access to authenticated internal users only via network segmentation or VPN, reducing exposure to untrusted attackers (this does not eliminate risk from malicious insiders or compromised accounts). User awareness training to avoid clicking suspicious links in DivvyDrive contexts provides defense-in-depth but should not be relied upon as primary mitigation.
More in Divvydrive
View allStored cross-site scripting in DivvyDrive 4.8.2.9 through 4.8.3.1 enables remote attackers to inject malicious scripts t
Remote attackers can cause excessive resource allocation and flooding attacks in DivvyDrive 4.8.2.19 through 4.8.3.1 by
Cross-Site Request Forgery in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote attackers to execute unauthorized actions
Stored cross-site scripting in DivvyDrive (versions 4.8.2.23 through before 4.8.3.1) allows authenticated low-privilege
Stored XSS in DivvyDrive versions v.4.8.2.23 through before v.4.8.3.1 enables an authenticated low-privilege user to inj
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today