Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54165— Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Quick assessment

Affected
smgdkngt dobase
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dobase 是一个开源、可自托管的工作区，支持安装扩展工具。在 2026.06.03 之前的版本中，在公开且无需身份验证的共享文件夹图片库中，存在一个一键式存储型基于 DOM 的跨站脚本攻击（XSS）漏洞。 文件的 （名称）字段完全由攻击者控制，且从未经过净化处理。该名称值通过经 ERB 转义的 属性进行往返传输，随后被 解码回原始值，并未经任何转义，直接由 Stimulus 控制器重新注入到 中。任何拥有文件共享权限的已认证工作区成员都可以存储恶意载荷；而触发漏洞的受害者可以是任何持有公开分享链接的人（无需认证

CVSS 6.4 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54165

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)
Source: CVE Program / CVE List V5
Vulnerability Description
Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting (XSS) vulnerability in the public, unauthenticated shared-folder image gallery. A file's `name` is fully attacker-controlled and is never sanitized. It is round-tripped through an ERB-escaped `data-name` attribute, decoded back to its raw value by `el.dataset.name`, and then re-injected into `innerHTML` by the `public-gallery` Stimulus controller with no escaping. Any authenticated workspace member who can share a Files folder can store a payload; the victim is anyone with the public share link (no authentication required). The global Content-Security-Policy is sent report-only (not enforcing), so an inline `onerror` handler executes — this is an executing XSS, not a CSP-mitigated injection. Version 2026.06.03 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
smgdkngt dobase < 2026.06.03 -

II. Public POCs for CVE-2026-54165

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54165

请登录查看更多情报信息。

Other References for CVE-2026-54165 (1)

IV. Related Vulnerabilities

Same weakness: CWE-79

V. Comments for CVE-2026-54165

No comments yet

Leave a comment