Medium severity · published Oct 13, 2026
CVE-2026-110228
wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the predictable /uploads/import/<user-id>.html path to execute script in victims' wallabag sessions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wallabag · wallabag
2.6.13 through 2.6.14 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110228
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110228
third-party-advisory
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wallabag-pocket-html-failed-import-stored-xss
technical-description
https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/src/Wallabag/ImportBundle/Controller/HtmlController.php#L28-L54
technical-description
https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/app/config/wallabag.yml#L169-L177
technical-description
https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/web/.htaccess#L50-L56
product
https://github.com/wallabag/wallabag
third-party-advisory
https://www.vulncheck.com/advisories/wallabag-2.6.13-through-2.6.14-stored-xss-via-failed-html-import-upload
More from wallabag
6.5
CVE-2023-0737
wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint
6.5
CVE-2023-4455
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3
6.5
CVE-2023-3566
A vulnerability was found in wallabag 2.5.4
6.5
CVE-2023-0735
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4
6.4
CVE-2026-82081
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export