CVE-2026-110228: wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload
wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the predictable /uploads/import/<user-id>.html path to execute script in victims' wallabag sessions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required from a victim?
An attacker must be authenticated to wallabag and able to trigger a failed Pocket HTML, Pocket CSV, or Shaarli import using a crafted HTML file. A victim must then load the attacker-hosted upload in their wallabag session for the script to execute.
What makes the uploaded payload reachable after a failed import?
A crafted HTML file containing script but no anchor elements can remain after the import fails. It is left at the predictable path /uploads/import/<user-id>.html, where <user-id> is the uploading user's identifier.
What permissions does the attacker need?
The attacker needs a wallabag account; the issue does not describe unauthenticated exploitation. The CVSS vector also indicates low privileges are required.