OMNISPACE AGORA PROJECT · CVE-2026-63166 · Other
NO FIX YET
Omnispace Agora Project through 26.10.0 renders imported directory and CSV values into HTML without escaping. A crafted CSV cell can carry a script payload that runs in the browser of the administrator who performs the import.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running Omnispace Agora Project 26.10.0 or earlier where administrators import directory or CSV data. Exposure depends on someone supplying a malicious CSV or directory entry that an admin then imports. Deployments that do not use the person import feature are unlikely to be exposed.
Not affected if auth-required, no-csv-import
Who cares agora, omnispace, php, self-hosted
26.10.0 or earlier.VuePersonsImportExport.php in the installation.No fix yet, per the sources.
Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.