CVE-2026-110101

5.4Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers can run arbitrary JavaScript in victims' browsers to hijack sessions or act on their behalf. The attacker needs an account to upload the file, and the victim must view the uploaded attachment.

Root cause

Datum file uploads lack MIME type validation, allowing uploaded HTML files to be stored and served directly as text/html.

Affected systems

Koillection through 1.8.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade to a version newer than 1.8.4 when available. As an interim mitigation, configure the web server (such as Nginx or Apache) to force 'Content-Type: application/octet-stream' or set 'Content-Disposition: attachment' with 'X-Content-Type-Options: nosniff' on the /uploads/ path.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads, executing JavaScript in victims' sessions to perform actions on their behalf.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110101