wallabag 2.6.13 through 2.6.14 contains a stored cross‑site scripting flaw that allows an authenticated user to host arbitrary HTML by uploading a file during a failed Pocket HTML, Pocket CSV or Shaarli import. The attacker crafts an HTML file containing JavaScript, ensuring that no anchor elements are present, and the import process writes the file to the predictable /uploads/import/<user‑id>.html location. When another authenticated user views the import page, the browser executes the stored script, enabling script execution in the victim’s browser session. This can be used for session hijacking, data theft, or further propagation on the victim’s accounts.

The vulnerability affects the wallabag product from the wallabag vendor, specifically versions 2.6.13 and 2.6.14.

The CVSS score of 5.1 indicates a moderate impact with an accessible attack vector that requires authentication, as the exploit is exercised through the import interface. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the web‑based import feature where authenticated users can upload files. An attacker must first authenticate and then trigger a failed import with a specially crafted file to achieve the stored XSS. The path to the uploaded file is predictable, making repeat exploitation straightforward once the vulnerability is known.