Stored Cross-Site Scripting Vulnerability in Koillection by Benjamin Jonard
CVE-2026-110101

5.1MEDIUM

Key Information:

Vendor: Benjaminjonard
Status: Koillection
Vendor: CVE Published:; 13 October 2026

🔔 Create Benjaminjonard Vulnerability Alert

What is CVE-2026-110101?

Koillection versions up to 1.8.4 are vulnerable to a stored cross-site scripting (XSS) flaw, whereby authenticated users can upload malicious HTML files as Datum file attachments. The lack of MIME type restrictions allows these files to be served as text/html from the public/uploads directory. This can enable attackers to execute JavaScript in the context of victims' sessions, facilitating actions on their behalf through the POST /api/data/{id}/file endpoint. Proper input validation and restrictions on file uploads are essential to mitigate such risks.