CVE-2026-63166
Omnispace Agora Project 26.10.0 Stored XSS via CSV Import Preview
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.
| CWE | CWE-79 |
| Vendor | omnispace |
| Product | agora project |
| Published | Nov 13, 2026 |
| Last Updated | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for omnispace agora project
Be the first to know when new medium vulnerabilities affecting omnispace agora project are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Omnispace / Agora Project
0 ≤ 26.10.0
References
akailabs.fr: https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63166-second-order-xss-in-ldap-import-preview agora-project.net: https://www.agora-project.net/ vulncheck.com: https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-csv-import-preview
Credits
Geoffrey Robert of akailabs Valentin Holubec of akailabs