CVE-2026-110101: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in benjaminjonard Koillection

CVE-2026-110101 describes a stored cross-site scripting vulnerability in benjaminjonard's Koillection through version 1.8.4. The flaw arises because the application allows authenticated users to upload HTML files as Datum file attachments without enforcing MIME type restrictions. These uploaded files are served from the public/uploads directory with a text/html content type. Consequently, malicious JavaScript embedded in these HTML files can execute in the context of other users' sessions, potentially allowing attackers to perform unauthorized actions on their behalf.

The vulnerability enables attackers with authenticated access to upload malicious HTML payloads that execute JavaScript in the browsers of other users who access these files. This can lead to session hijacking or unauthorized actions performed with the victim's privileges. The CVSS 4.0 score of 5.1 indicates a medium severity impact with network attack vector, low attack complexity, and requiring privileges and user interaction.

No official patch or remediation information is provided in the vendor advisory or CVE data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to prevent uploading HTML files or implement server-side MIME type validation to block HTML uploads. Additionally, consider serving uploaded files with safe content types or isolating them from user sessions to prevent script execution.