CVE-2026-110228

The wallabag application versions 2.6.13 through 2.6.14 is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability occurs during a failed Pocket HTML , Pocket CSV , or Shaarli import. An authenticated attacker can upload an HTML file containing scripts but no anchor elements, wh...