CVE-2026-54165

Received Received - Intake

Stored DOM-Based XSS in Dobase Public Gallery

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting (XSS) vulnerability in the public, unauthenticated shared-folder image gallery. A file's `name` is fully attacker-controlled and is never sanitized. It is round-tripped through an ERB-escaped `data-name` attribute, decoded back to its raw value by `el.dataset.name`, and then re-injected into `innerHTML` by the `public-gallery` Stimulus controller with no escaping. Any authenticated workspace member who can share a Files folder can store a payload; the victim is anyone with the public share link (no authentication required). The global Content-Security-Policy is sent report-only (not enforcing), so an inline `onerror` handler executes — this is an executing XSS, not a CSP-mitigated injection. Version 2026.06.03 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-54165

Affected Vendors & Products

Vendor	Product	Version / Range
dobase	dobase	to 2026.06.03 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored DOM-based cross-site scripting (XSS) vulnerability in Dobase, an open-source self-hosted workspace. Attackers can upload files with malicious names that bypass sanitization and execute arbitrary JavaScript when viewed by victims via a public share link. The vulnerability exists because file names are not sanitized and are re-injected into HTML without proper escaping.

Detection Guidance

Check for unauthenticated public gallery shares in Dobase versions prior to 2026.06.03. Inspect shared folder names for suspicious payloads in the data-name attribute or innerHTML. Look for unexpected script execution in browser consoles when accessing public shares.

Impact Analysis

An attacker could steal sensitive data, perform actions on behalf of users, or deface the application by exploiting this XSS. Victims do not need to be authenticated since the attack occurs via a public share link. Any authenticated workspace member who can share a folder can introduce the malicious payload.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting personal and health data. Unauthorized script execution may expose sensitive information, resulting in non-compliance with data protection regulations and potential legal consequences.

Mitigation Strategies

Upgrade Dobase to version 2026.06.03 or later. Disable public gallery sharing if not needed. Review shared folders for malicious files and remove any suspicious payloads. Monitor network traffic for unusual activity from public shares.

Hi! I’m here to help you understand CVE-2026-54165. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70