CVE-2026-110101: Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads, executing JavaScript in victims' sessions to perform actions on their behalf.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated Koillection account and permission to upload a file attachment to a Datum. Exploitation also requires a victim to open the uploaded HTML attachment in a browser.
What conditions make an installation exposed?
Instances that allow authenticated users to upload Datum file attachments are exposed because uploaded HTML can be served from public/uploads as text/html. The affected behavior is reported through Koillection 1.8.4.
What can an attacker do after a victim opens a malicious attachment?
JavaScript in the uploaded HTML executes in the victim's session. This can allow the attacker to perform actions on the victim's behalf and access or modify information available through that session.
What can be done while a fix is unavailable?
Restrict attachment-upload permissions to trusted users and prevent HTML uploads from being publicly served as text/html. Review existing Datum attachments in public/uploads for HTML files and remove or quarantine untrusted uploads.