The vulnerability is an improper neutralization of script‑related tags that allows a basic XSS flaw. An attacker can inject JavaScript that runs in the context of the application, potentially defacing web pages, stealing session cookies, or performing actions on behalf of the user. This weakness can compromise the confidentiality, integrity, and availability of data accessed through the web interface.

Affected installations of DivvyDrive are those running version 4.8.2.9 through any release prior to 4.8.3.2; any instance of DivvyDrive before the 4.8.3.2 update is vulnerable.

The CVSS score of 8.8 categorises this flaw as high severity. No EPSS score is reported and the vulnerability is not listed in CISA's KEV catalog, so the exact likelihood of exploitation is uncertain but the absence of known active exploits does not mitigate the risk. The likely attack vector is a web interface or API that accepts user input without proper sanitization; based on the description, it is inferred that authentication or elevated privileges are not required for exploitation. Once a vulnerable endpoint is accessed, arbitrary scripts can execute with the privileges of the victim user.