Koillection EUVD-2026-98934

Exploitation requires (1) an authenticated Koillection account with permission to create or edit a Datum and upload file attachments through POST /api/data/{id}/file, and (2) the absence of MIME-type restrictions on that upload, which lets an HTML file be stored and later served as text/html from the public/uploads path. The payload is stored, not reflected, so (3) a separate victim must subsequently open/view the uploaded attachment in an authenticated session for the JavaScript to execute. Limiting factors: this is not remote-unauthenticated - it needs a valid low-privilege login (PR:L) and victim interaction (UI:P); impact is limited to the victim's browser/session (no server-side code execution or data impact), reducing realistic severity below the raw network-vector reading.

This is a medium-severity stored XSS (vendor CVSS 4.0 base 5.1) that aligns well with its own data: the attack vector is network (AV:N) with low complexity (AC:L), but exploitation is gated by two real factors - PR:L means the attacker needs an authenticated account on the Koillection instance, and UI:P means a victim must actively view the malicious attachment. The impact is confined to the subsequent-system scope (SC:L/SI:L) reflecting JavaScript execution in a victim's browser/session rather than compromise of the server itself (VC/VI/VA all N). No EPSS score, CISA KEV listing, or POC reference was provided in the input, so there is no evidence of active exploitation or published exploit code; this is a disclosure-stage finding from VulnCheck, not a widely-weaponized bug. The combination of required authentication, required victim interaction, a niche self-hosted product, and no exploitation signals places this as a genuine but low-urgency issue rather than an emergency - it is a real flaw worth patching but not a high-priority mass-exploitation risk. Note one data gap: the 1.8.4 release notes provided do not mention a fix for this XSS (they cite a CSRF fix and generic dependency CVE upgrades), and the CVE states the product is vulnerable 'through 1.8.4', so a confirmed fixed version is not evident from the supplied data - verify remediation status with the vendor.

An attacker who holds any authenticated (low-privilege) account on a shared Koillection instance creates or edits a Datum and uploads a crafted HTML file as a file attachment via POST /api/data/{id}/file, bypassing MIME-type restrictions. Because the file is later served as text/html directly from public/uploads, when another user (e.g. an administrator or other member) opens that attachment link the embedded JavaScript executes in their session, letting the attacker perform actions on their behalf. No public exploit code was identified at time of analysis, and successful exploitation depends on a victim opening the attacker-supplied file.