CVE-2025-29746: Koillection Cross Site Scripting Vulnerability
Summary
CVE-2025-29746: Koillection Cross Site Scripting vulnerability. Affects koillection/koillection versions < 1.6.12. Fixed in 1.6.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Koillection is a PHP-based application designed for managing collections, wishlists, and albums. It provides users with the ability to organize and share their collections online. However, version 1.6.10 of Koillection has been identified with a Cross Site Scripting (XSS) vulnerability that can be exploited by attackers to escalate privileges, potentially compromising user data and application integrity.
Vulnerability Detail
The Cross Site Scripting vulnerability in Koillection version 1.6.10 allows remote attackers to inject malicious scripts into the application through the collection, wishlist, and album components. This vulnerability arises from inadequate input validation, which can lead to unauthorized actions being performed on behalf of users. If exploited, attackers could manipulate user sessions, steal sensitive information, or perform actions without user consent.
How To Fix
Minimum fixed version
1.6.12
This is the first release that contains the fix.
composer require koillection/koillection:1.6.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, sanitize user inputs and escape outputs in the affected components (collection, wishlist, and album) to mitigate the risk of XSS attacks until the package can be updated. Implementing a Content Security Policy (CSP) can also help reduce the impact of potential XSS vulnerabilities.
Conclusion
The Cross Site Scripting vulnerability in Koillection version 1.6.10 poses a significant risk to users and their data. It is crucial to update to version 1.6.12 or later to protect against potential exploitation. Additionally, employing best practices for input validation and output encoding can further enhance security.
See every vulnerability recorded for koillection/koillection →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, attackers could gain unauthorized access to user accounts, manipulate data, and compromise the integrity of the application.
Yes, implementing proper input validation, output encoding, and using security headers like Content Security Policy can help prevent XSS vulnerabilities.
If immediate updates are not possible, ensure to implement input sanitization and output encoding as a temporary measure to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for koillection/koillection.
