CVE-2026-110228

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in wallabag via Failed Import Handling

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the predictable /uploads/import/<user-id>.html path to execute script in victims' wallabag sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110228

EUVD

EUVD-2026-99012

Affected Vendors & Products

Vendor	Product	Version / Range
wallabag	wallabag	2.6.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in wallabag versions 2.6.13 through 2.6.14. An authenticated user can upload a malicious HTML file during a failed import process (Pocket HTML, Pocket CSV, or Shaarli). The file is saved to a predictable path like /uploads/import/<user-id>.html. When accessed, the embedded script executes in victims' wallabag sessions.

Detection Guidance

Check for suspicious HTML files in the /uploads/import/ directory with predictable paths like /uploads/import/<user-id>.html. Look for files containing script tags without anchor elements. Review web server logs for failed import attempts or unexpected file uploads.

Impact Analysis

An attacker could steal session cookies, hijack accounts, or perform actions on behalf of victims. If the victim is an administrator, the attacker might escalate privileges. The attack requires an authenticated user to upload the file and victims to access the malicious link.

Mitigation Strategies

Upgrade wallabag to a patched version beyond 2.6.14. Restrict file uploads to trusted MIME types and validate file content. Ensure uploaded files are not publicly accessible or stored in predictable paths. Review and remove any suspicious HTML files in /uploads/import/.

Hi! I’m here to help you understand CVE-2026-110228. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70