{"id":"CVE-2026-110101","title":"Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions","summary":"Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/dat…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"benjaminjonard","product":"Koillection","affected":["Koillection <= 1.8.4"],"published":"2026-10-13","updated":"2026-10-16","sourceUpdated":"2026-10-16T23:16:58.910","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110101","references":[{"url":"https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Entity/Datum.php#L141-L145","label":"disclosure@vulncheck.com"},{"url":"https://github.com/benjaminjonard/koillection/blob/1.8.4/src/Service/ImageHandler.php#L43-L50","label":"disclosure@vulncheck.com"},{"url":"https://github.com/benjaminjonard/koillection/issues/1609","label":"disclosure@vulncheck.com"},{"url":"https://github.com/benjaminjonard/koillection/releases/tag/1.8.4","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/koillection-through-1.8.4-stored-xss-via-datum-file-attachment-uploads","label":"disclosure@vulncheck.com"},{"url":"https://github.com/benjaminjonard/koillection/issues/1609","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00264,"epssPercentile":0.1819,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T22:11:44.598138Z"},"ingestedAt":"2026-10-13T17:38:53.184Z","slug":"CVE-2026-110101","body":"## Overview\n\nKoillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads, executing JavaScript in victims' sessions to perform actions on their behalf.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":223421,"id":"CVE-2026-110101","ts":1792191328707,"field":"exploit_available","old":"false","new":"true"}]}