CVE-2026-63166

CVSS 6.1 (medium) · published 2026-11-13

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.

Weakness: CWE-79

Source: NVD CVE-2026-63166

References

• https://www.agora-project.net/
• https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63166-second-order-xss-in-ldap-import-preview
• https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-csv-import-preview

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.