CVE-2026-110101
5.4 MEDIUMpublic exploit availablePublished 2026-10-13 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads, executing JavaScript in victims' sessions to perform actions on their behalf.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Public exploit & PoC references
- https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Entity/Datum.php#L141-L145
- https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Service/ImageHandler.php#L43-L50
- https://github.com/benjaminjonard/koillection/issues/1609
- https://github.com/benjaminjonard/koillection/releases/tag/1.8.4
- https://github.com/benjaminjonard/koillection/issues/1609
All references
- https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Entity/Datum.php#L141-L145
- https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Service/ImageHandler.php#L43-L50
- https://github.com/benjaminjonard/koillection/issues/1609
- https://github.com/benjaminjonard/koillection/releases/tag/1.8.4
- https://www.vulncheck.com/advisories/koillection-through-1.8.4-stored-xss-via-datum-file-attachment-uploads
- https://github.com/benjaminjonard/koillection/issues/1609
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2016-20098PoC
- MEDIUMCVE-2023-54408PoC
- UNSCOREDCVE-2023-5648
- MEDIUMCVE-2024-31027
- MEDIUMCVE-2024-34321
- MEDIUMCVE-2024-58391PoC
- MEDIUMCVE-2025-12828
- MEDIUMCVE-2025-13533PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.