CVE-2026-110101Published
Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-110101 · Microsoft / collected KEV context
cve-program · CVE-2026-110101
- https://github.com/benjaminjonard/koillection/issues/1609
- https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Service/ImageHandler.php#L43-L50
- https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Entity/Datum.php#L141-L145
- https://github.com/benjaminjonard/koillection/releases/tag/1.8.4
- https://www.vulncheck.com/advisories/koillection-through-1.8.4-stored-xss-via-datum-file-attachment-uploads
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.