CVE-2026-110228
wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload
wallabag wallabag
CVSS
5.1MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the predictable /uploads/import/<user-id>.html path to execute script in victims' wallabag sessions.
Text from CVE List
Affected versions 1
- wallabagaffected: 2.6.13 through 2.6.14CVE List
References 6
- vulncheck.com/advisories/wallabag-2.6.13-through-2.6.14-stored-xss-via-failed-html-import-uploadAdvisoryvia CVE List
- hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wallabag-pocket-html-failed-import-stored-xssExploitvia CVE List
- github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/src/Wallabag/ImportBundle/Controller/HtmlController.php#L28-L54Referencevia CVE List
- github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/app/config/wallabag.yml#L169-L177Referencevia CVE List
- github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/web/.htaccess#L50-L56Referencevia CVE List
- github.com/wallabag/wallabagReferencevia CVE List