Description
wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the predictable /uploads/import/<user-id>.html path to execute script in victims' wallabag sessions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
wallabag wallabag
Default version status: unaffected
2.6.13 to ≤ 2.6.14affected
pkg:composer/wallabag/wallabagReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/wallabag-pocket-html-failed-import-stored-xss ↗
- https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/src/Wallabag/ImportBundle/Controller/HtmlController.php#L28-L54 ↗
- https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/app/config/wallabag.yml#L169-L177 ↗
- https://github.com/wallabag/wallabag/blob/74cbfd945bc316b5cf0308ba56e32fd2ed3443c0/web/.htaccess#L50-L56 ↗
- https://github.com/wallabag/wallabag ↗
- https://www.vulncheck.com/advisories/wallabag-2.6.13-through-2.6.14-stored-xss-via-failed-html-import-upload ↗