{"id":"CVE-2026-110101","summary":"Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads","details":"Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads, executing JavaScript in victims' sessions to perform actions on their behalf.","modified":"2026-10-15T02:47:23.800844527Z","published":"2026-10-13T16:53:05.007Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110101.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110101.json"},{"type":"ADVISORY","url":"https://github.com/benjaminjonard/koillection/releases/tag/1.8.4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110101"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/koillection-through-1.8.4-stored-xss-via-datum-file-attachment-uploads"},{"type":"REPORT","url":"https://github.com/benjaminjonard/koillection/issues/1609"},{"type":"PACKAGE","url":"https://github.com/benjaminjonard/koillection"},{"type":"ARTICLE","url":"https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Entity/Datum.php#L141-L145"},{"type":"ARTICLE","url":"https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Service/ImageHandler.php#L43-L50"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/benjaminjonard/koillection","events":[{"introduced":"0"},{"fixed":"37506b4d40da1e49d64fcdcfe981d861d14df620"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"last_affected":"1.8.4"},{"fixed":"1.8.4"}]}}],"versions":["1.8.3","1.8.2","1.8.1","1.8.0","1.7.1","1.7.0","1.6.18","1.6.17","1.6.16","1.6.15","1.6.14","1.6.13","1.6.12","1.6.11","1.6.10","1.6.9","1.6.8","1.6.7","1.6.6","1.6.5","1.6.4","1.6.3","1.6.2","1.6.1","1.5.16","1.5.15","1.5.14","1.5.13","1.5.12","1.5.11","1.5.10","1.5.9","1.5.8","1.5.7","1.5.6","1.5.5","1.5.4","1.5.3","1.5.2","1.5.1","1.5.0","1.4.13","1.4.12","1.4.11","1.4.10","1.4.9","1.4.8","1.4.7","1.4.6","1.4.5","1.4.4","1.4.3","1.4.2","1.4.1","1.4.0","1.3.18","1.3.17","1.3.16","1.3.15","1.1.7","1.1.6","1.1.5","1.1.4","1.1.3","1.1.2","1.1.1","1.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110101.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}