Vulnerabilities

TI-2026-71987 CVE-2026-110101 · GHSA-2rcm-w8cq-6hv5

Stored cross-site scripting in Koillection via Datum file attachments

MEDIUM 56

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00264 Published 2026-10-13 No fix listed CWE-79

TI-2025-08937 CVE-2025-9747

Koillection csrf_protection_controller.js cross-site request forgery

MEDIUM 63

A vulnerability has been found in Koillection up to 1.6.18.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00423 Published 2025-08-31 Fixed in 1.7.0 CWE-352

TI-2025-21176 CVE-2025-29746 · GHSA-fxvx-gfmr-5xfj

Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to…

MEDIUM 60

Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00291 Published 2025-05-07 Fixed in 1.6.12 CWE-79

Vulnerabilities

Filters

Stored cross-site scripting in Koillection via Datum file attachments

Koillection csrf_protection_controller.js cross-site request forgery

Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to…