Stored Cross-Site Scripting in wallabag Product by Wallabag

CVE-2026-110228

What is CVE-2026-110228?

Versions 2.6.13 and 2.6.14 of wallabag contain a vulnerability that allows authenticated users to exploit stored cross-site scripting. This occurs when users trigger a failed import of Pocket HTML, Pocket CSV, or Shaarli. An attacker can upload a malicious HTML file containing script code, which is stored in a predictable location at /uploads/import/.html. Consequently, this allows the attacker's script to execute within the wallabag sessions of other users, potentially compromising their accounts.

References