Wallabag

12 CVEs across 3 Wallabag products. Browse Wallabag vulnerabilities, severities, and proof-of-concept exploits.

Wallabag products with known CVEs

ProductCVEs
Wallabag11
Wallabag/wallabag8
Android-App1
Wallabag CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-820892026-08-28The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
CVE-2026-82081Medium6.42026-08-28wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.
CVE-2023-0737Medium6.52024-11-15wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/de…
CVE-2023-4455Medium6.52023-08-21Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
CVE-2023-4454Medium5.72023-08-21Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
CVE-2023-3566Low3.52023-07-10A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /confi…
CVE-2023-0734Medium5.32023-03-05Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.
CVE-2023-0736Medium5.42023-02-07Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
CVE-2023-0735Medium6.52023-02-07Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
CVE-2023-0610Medium4.32023-02-01Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
CVE-2023-0609Medium4.32023-02-01Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
CVE-2018-11352Medium4.02018-09-21The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerab…