CVE-2026-22867: LaSuite Doc affected by Stored XSS via Interlinking Block
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22867?
CVE-2026-22867 has a medium severity rating due to the potential for exploitation via stored XSS.
How do I fix CVE-2026-22867?
To fix CVE-2026-22867, update LaSuite Doc to version 4.4.0 or later.
What versions of LaSuite Doc are affected by CVE-2026-22867?
CVE-2026-22867 affects LaSuite Doc versions from 3.8.0 to 4.3.0.
What type of vulnerability is CVE-2026-22867?
CVE-2026-22867 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.
Can CVE-2026-22867 be exploited by an unprivileged user?
Yes, CVE-2026-22867 can be exploited by any user who has access to the Interlinking feature.