CVE-2026-110101 Details
Description
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads, executing JavaScript in victims' sessions to perform actions on their behalf.
A stored cross-site scripting vulnerability has been identified in Koillection versions through 1.8.4. This issue allows authenticated users to upload HTML files as Datum file attachments without proper MIME type restrictions. The uploaded HTML payloads are served as text/html from the public/uploads directory, enabling the execution of JavaScript in the context of the victim's session, potentially leading to unauthorized actions on their behalf.
Users are advised to update to Koillection version 1.8.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/benjaminjonard/koillection/issues/1609 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Entity/Datum.php#L141-L145 | [email protected] | Source CodeVendor |
| https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Service/ImageHandler.php#L43-L50 | [email protected] | Source CodeVendor |
| https://github.com/benjaminjonard/koillection/issues/1609 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/benjaminjonard/koillection/releases/tag/1.8.4 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/koillection-through-1.8.4-stored-xss-via-datum-file-attachment-uploads | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Koillection | <= 1.8.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |