wallabag EUVD-2026-99012

Requires an authenticated wallabag account (PR:L). The attacker must trigger a FAILED import using one of three specific features - Pocket HTML import, Pocket CSV import, or Shaarli import - while supplying an HTML file that contains script elements but deliberately NO anchor elements, which is the condition that leaves the malicious file retained at the predictable path /uploads/import/<user-id>.html. Exploitation is further limited by requiring victim interaction (UI:P): a separate logged-in user must open the crafted URL for the script to execute. It does not affect default behavior absent a user intentionally abusing the import feature, and it grants no impact to the wallabag server itself - only to other users' browser sessions.

This is a genuine but modest-severity issue, correctly rated medium (CVSS 4.0 base 5.1). The CVSS 4.0 vector tells a consistent story: network vector (AV:N) and low complexity (AC:L), but exploitation requires an authenticated attacker (PR:L) and passive victim interaction (UI:P), with no impact to the vulnerable system itself (VC:N/VI:N/VA:N) and only low confidentiality and integrity impact to a subsequent system (SC:L/SI:L) - i.e. the victim's browser session, which is exactly what a stored XSS produces. No EPSS score, no CISA KEV listing, and no POC flag are present in the input, so there is no signal of active or widespread exploitation; the signals are not conflicting, they are simply sparse. The combination of required authentication, required victim interaction, and the absence of exploitation telemetry places this well below true-priority status. For a self-hosted bookmarking application this is a defense-in-depth bug to patch on a normal cycle rather than an emergency. Note that technical writeups exist (a hackmd analysis and a VulnCheck advisory) describing the mechanism in detail, which lowers the effort to reproduce even though no packaged exploit is indicated.

An authenticated wallabag user deliberately triggers a failed Pocket HTML, Pocket CSV, or Shaarli import that uploads an HTML file containing script but no anchor elements; the file is retained at the predictable /uploads/import/<user-id>.html path. The attacker then lures another logged-in wallabag user to open that URL, executing attacker-controlled script in the victim's authenticated session. No public exploit identified at time of analysis, though detailed technical writeups are referenced.