TI-2026-71987 Aliases CVE-2026-110101 GHSA-2rcm-w8cq-6hv5

Stored cross-site scripting in Koillection via Datum file attachments

MEDIUM 56CWE-79Published 2026-10-13 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Koillection through 1.8.4 contains stored cross-site scripting (CWE-79) because it accepts HTML files as Datum file attachments without MIME restrictions. An authenticated user with low privileges can upload such a file, which is served as text/html and runs JavaScript in a victim's session, performing actions on the victim's behalf.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads, executing JavaScript in victims' sessions to perform actions on their behalf.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00264 18th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
benjaminjonard	Koillection	up to 1.8.4	—	No fix listed	CNA

Koillection Vendorbenjaminjonard Affected up to 1.8.4 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Koillection.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Timeline

2026-10-13 Threatist record created from CVE-2026-110101
2026-10-13 Alias added: GHSA-2rcm-w8cq-6hv5
2026-10-18 CISA SSVC decision points changed
2026-10-18 Priority changed: LOW → MEDIUM

References

Other 4

TI-2025-08937 Koillection csrf_protection_controller.js cross-site request forgery CVSS 4.0MEDIUM 5.3
TI-2025-21176 Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences