Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110228— wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload

Quick assessment

Affected
wallabag wallabag
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

wallabag 2.6.13 至 2.6.14 版本存在一个存储型跨站脚本（XSS）漏洞。该漏洞允许已认证用户通过触发 Pocket HTML、Pocket CSV 或 Shaarli 导入失败的情况，托管任意的 HTML 内容。攻击者可以上传一个包含脚本但无锚点元素（anchor elements）的 HTML 文件，并将其保留在可预测的路径 下，从而在受害者的 wallabag 会话中执行恶意脚本。

CVSS 5.4 · Medium EPSS 0.25% · P15

Possible ATT&CK Techniques 1 AI

T1189 · Drive-by Compromise

Affected Version Matrix 1

VendorProduct Version RangeStatus
wallabag wallabag 2.6.13≤ 2.6.14 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110228

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload
Source: CVE Program / CVE List V5
Vulnerability Description
wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the predictable /uploads/import/<user-id>.html path to execute script in victims' wallabag sessions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
wallabag wallabag 2.6.13 ~ 2.6.14 -

II. Public POCs for CVE-2026-110228

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110228

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110228 (1)

Vendor Advisories for CVE-2026-110228 (1)

Security Blog Posts for CVE-2026-110228 (1)

Other References for CVE-2026-110228 (1)

IV. Related Vulnerabilities

Same product: wallabag
Same vendor: wallabag
Same weakness: CWE-79

V. Comments for CVE-2026-110228

No comments yet

Leave a comment