Stored Cross-Site Scripting Vulnerability in LaSuite Doc by Suitenumerique

CVE-2026-22867

What is CVE-2026-22867?

In LaSuite Doc, a popular collaborative note-taking and documentation platform, a stored cross-site scripting (XSS) vulnerability has been identified in the Interlinking feature. This flaw arises when users create links to other documents within the editor, as the URLs are not subjected to proper validation. An attacker with document editing privileges can exploit this vulnerability by injecting an unsafe javascript: URL. When other users click on the compromised link, arbitrary code can be executed within their browsers, potentially leading to unauthorized actions or data exposure. Users are advised to update to version 4.4.0 or later to mitigate this issue.

References