{"id":"CVE-2026-110228","revision":"0254837b13504b5da415a546e90f33dc","records":[{"revision":"0254837b13504b5da415a546e90f33dc","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110228","aliases":[],"title":"wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload","description":"wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the predictable /uploads/import/<user-id>.html path to execute script in victims' wallabag sessions.","state":0,"publishedAt":"2026-10-13T18:50:12.21+00:00","modifiedAt":"2026-10-14T16:23:45.608+00:00","affected":[{"ecosystem":"Vendor product","name":"wallabag","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"wallabag\",\n                    \"product\": \"wallabag\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.13\",\n                            \"lessThanOrEqual\": \"2.6.14\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:composer/wallabag/wallabag\",\n                    \"repo\": \"https://github.com/wallabag/wallabag\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":5.1,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4,"severity":"MEDIUM"}],"references":["https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wallabag-pocket-html-failed-import-stored-xss","https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/src/Wallabag/ImportBundle/Controller/HtmlController.php#L28-L54","https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/app/config/wallabag.yml#L169-L177","https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/web/.htaccess#L50-L56","https://github.com/wallabag/wallabag","https://www.vulncheck.com/advisories/wallabag-2.6.13-through-2.6.14-stored-xss-via-failed-html-import-upload"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110228","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110228","identifiers":["CVE-2026-110228"]},"retained":false,"historicalAffected":[]}],"coverage":[]}