{"schema":"threatline.record/2","record":{"id":"CVE-2026-110228","aliases":[],"summary":"wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload","details":"wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the predictable /uploads/import/<user-id>.html path to execute script in victims' wallabag sessions.","categories":["Unclassified"],"product":"wallabag","vendor":"wallabag","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110228","source_modified_at":"2026-10-14T16:23:45.608Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"wallabag","vendor":"wallabag","versions":[{"version":"2.6.13","lessThanOrEqual":"2.6.14","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00247,"percentile":0.15091,"score_date":"2026-10-23"},"published_at":"2026-10-13T18:50:12.210Z","modified_at":"2026-10-14T16:23:45.608Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110228","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T16:23:45.608Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110228","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wallabag-pocket-html-failed-import-stored-xss","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/src/Wallabag/ImportBundle/Controller/HtmlController.php#L28-L54","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/app/config/wallabag.yml#L169-L177","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/web/.htaccess#L50-L56","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/wallabag/wallabag","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/wallabag-2.6.13-through-2.6.14-stored-xss-via-failed-html-import-upload","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-14T16:23:12.126519Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T16:23:45.608Z","content_hash":"ffca1b1946a6a0b430ba8c36938e22e343cb95a0d7ae6ade61a399cc2f852a9e"}}