CVE-2026-110228

The wallabag application versions 2.6.13 through 2.6.14 is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability occurs during a failed Pocket HTML , Pocket CSV , or Shaarli import. An authenticated attacker can upload an HTML file containing scripts but no anchor elements, wh...

CVE-2026-110228: Improper Neutralization of Input During Web Page Generation

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...

PT-2026-111851

wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the...