CVE-2026-110101 in Koillection
Summary
by MITRE • 10/13/2026
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads, executing JavaScript in victims' sessions to perform actions on their behalf.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability represents a critical security flaw within the Koillection application, specifically affecting versions up through 1.8.4. This issue is classified as a Stored Cross-Site Scripting (XSS) vulnerability, which poses a significant risk to user data integrity and session security. The root cause of this weakness lies in insufficient input validation and MIME type enforcement during the file upload process. Specifically, the application fails to properly restrict or sanitize HTML files when they are uploaded as attachments for Datum records. This lack of restriction allows malicious actors to bypass standard content-type checks by uploading files that contain executable JavaScript code disguised as legitimate document attachments.
The technical mechanism of exploitation involves an authenticated user interacting with the API endpoint POST /api/data/{id}/file. By leveraging this interface, an attacker can upload a crafted HTML file containing malicious script payloads. Because the application does not enforce strict MIME type restrictions on uploaded files, these HTML documents are stored without sanitization and subsequently served to other users via the public/uploads directory as text/html content. When a victim user accesses or views the affected Datum record, their browser interprets the attached file as an executable web page rather than a static document. This results in the immediate execution of the embedded JavaScript within the context of the victim's active session with Koillection.
The operational impact of this vulnerability is severe due to its stored nature and the ability to execute arbitrary code in the user's browser environment. Unlike reflected XSS, where an attack requires social engineering to trick a user into clicking a malicious link, stored XSS persists on the server side, affecting every user who views the compromised content. Attackers can utilize this capability to perform actions on behalf of the victim without their knowledge or consent. Common attacks facilitated by such vulnerabilities include session hijacking, where attackers steal authentication cookies to impersonate legitimate users; credential harvesting through fake login forms injected into the page; and defacement of the application interface. Furthermore, if the compromised account possesses administrative privileges, an attacker could escalate their access to gain full control over the system, potentially leading to data exfiltration or further lateral movement within the network infrastructure.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific vector involves stored payloads delivered via file upload mechanisms, which also relates to CWE-436 Interpretation Conflict and CWE-20 Improper Input Validation. In terms of the MITRE ATT&CK framework, this attack scenario maps to T1059 Command and Scripting Interpreter for code execution and potentially T1078 Valid Accounts if used to maintain persistent access after stealing credentials. The lack of MIME type enforcement further highlights a failure in adhering to security best practices regarding file handling, often associated with CWE-434 Unrestricted Upload of File with Dangerous Type.
To mitigate this vulnerability, immediate action is required on the server side to enforce strict validation rules for uploaded files. Developers should implement allow-lists that restrict accepted MIME types and file extensions, ensuring that only expected document formats such as PDF or DOCX are processed while explicitly blocking HTML and script-based file types. Additionally, implementing Content Security Policy headers can help mitigate the impact of any remaining XSS vectors by restricting the sources from which scripts can be loaded. Input sanitization should also be applied to all user-supplied data before storage, although relying solely on output encoding is insufficient for stored vulnerabilities where the context changes upon retrieval. Upgrading Koillection to a version later than 1.8.4 that includes patches for this issue is the most effective long-term solution. Until an update is available, administrators should restrict access to file upload endpoints and monitor logs for suspicious activity involving HTML file uploads via the specified API endpoint.