CVE-2026-54165: Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)
Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting (XSS) vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never sanitized. It is round-tripped through an ERB-escaped data-name attribute, decoded back to its raw value by el.dataset.name, and then re-injected into innerHTML by the public-gallery Stimulus controller with no escaping. Any authenticated workspace member who can share a Files folder can store a payload; the victim is anyone with the public share link (no authentication required). The global Content-Security-Policy is sent report-only (not enforcing), so an inline onerror handler executes — this is an executing XSS, not a CSP-mitigated injection. Version 2026.06.03 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dobaseto a version that resolves this vulnerability.Fixed in 2026.06.03
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed?
Any authenticated workspace member who can share a Files folder can upload or rename a file with a malicious name and create a public share. Anyone who opens that public share link can be affected, including users who are not authenticated to Dobase.
Does exploitation require user interaction or a restrictive configuration?
The victim only needs to open the public shared-folder image gallery link. The application’s global Content-Security-Policy is report-only rather than enforcing, so inline event-handler payloads can execute.
Which releases are affected and what version fixes it?
Dobase versions prior to 2026.06.03 are affected. Version 2026.06.03 fixes the issue.
What can be done if upgrading is not immediately possible?
The available information supports limiting who can create public Files-folder shares and removing or disabling public shares created by untrusted workspace members. Treat existing public image-gallery shares as potentially unsafe until they can be reviewed or the instance is upgraded.