AI Engine ≤3.8.0 has an unauthenticated stored XSS (CVE-2026-96561), which can achieve Advisor indirect prompt injection via PHP error log injection

AI Engine 3.8.0 and earlier versions have an unauthenticated stored XSS vulnerability (CVE-2026-96561). An attacker can write malicious content into the PHP error log via the model_ parameter, thereby carrying out indirect prompt injection against Advisor. The vulnerability can be triggered without authentication, and the impact is limited to versions 3.8.0 and below.