Koillection through version 1.8.4 contains a stored cross‑site scripting flaw that allows an authenticated user to upload HTML files as Datum file attachments without MIME restrictions. The uploaded file is stored under public/uploads and served with a text/html content type, enabling embedded JavaScript to execute in the context of the victim’s browser sessions. This can lead to theft of session data, credential compromise or other malicious actions performed on behalf of the authenticated user.

The vulnerability affects the Koillection application bundled under the code name "Koillection" by developer Benjamin Jonard, specifically releases up to and including version 1.8.4. No other versions are known to be impacted.

The vulnerability is rated with a CVSS score of 5.1, indicating moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, so it is not currently known to be actively exploited. The attack requires valid user credentials to reach the vulnerable upload endpoint, thus the impact is limited to authenticated users. That said, the ability to execute arbitrary JavaScript can still be very damaging within the scope of those sessions.