{"id":"CVE-2026-63166","kind":"vulnerability","aliases":["CVE-2026-63166"],"related":[],"title":"Omnispace Agora: stored XSS via imported CSV runs script in admin browsers","description":"Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.","summary":"Omnispace Agora Project through 26.10.0 renders imported directory and CSV values into HTML without escaping. A crafted CSV cell can carry a script payload that runs in the browser of the administrator who performs the import.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Omnispace Agora Project","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["agora","omnispace","other","php","self-hosted"],"not_affected_if":["auth-required","no-csv-import"],"how_to_check":"- Check whether your deployment runs Omnispace Agora Project at version `26.10.0` or earlier.\n- Look for the file `VuePersonsImportExport.php` in the installation.","fix":null,"status":"open","published_at":"2026-11-13T17:17:33+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","triaged_at":"2026-11-13T17:49:02+00:00","updated_at":"2026-11-13T17:49:02+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T17:49:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Omnispace Agora: stored XSS via imported CSV runs script in admin browsers","impact":"medium","summary":"Omnispace Agora Project through 26.10.0 renders imported directory and CSV values into HTML without escaping. A crafted CSV cell can carry a script payload that runs in the browser of the administrator who performs the import.","audience":"businesses","category":"other","nicknames":[],"who_cares":["omnispace","agora","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in administrator's browser with admin privileges","analyst_note":"Confirm the fixed version and any vendor advisory; the NVD entry lists no fix or product ranges.","how_to_check":"- Check whether your deployment runs Omnispace Agora Project at version `26.10.0` or earlier.\n- Look for the file `VuePersonsImportExport.php` in the installation.","plain_action":"","product_name":"Omnispace Agora Project","needs_analyst":true,"not_affected_if":["no-csv-import","auth-required"],"who_is_affected":"Organizations running Omnispace Agora Project 26.10.0 or earlier where administrators import directory or CSV data. Exposure depends on someone supplying a malicious CSV or directory entry that an admin then imports. Deployments that do not use the person import feature are unlikely to be exposed.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4650,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-63166':15A,18A '26.10.0':33B,69C 'admin':11A 'administr':60B,140C,151C 'agora':2A,20A,22B,30B,66C 'allow':79C 'arbitrari':146C 'attack':80C,117C 'attribut':106C,126C 'attribute-breakout':125C 'breakout':127C 'browser':12A,57B,137C 'carri':49B 'cell':47B,102C,122C 'contain':70C,123C 'context':152C 'control':87C 'craft':45B,119C 'cross':74C 'cross-sit':73C 'csv':7A,38B,46B,94C,121C 'cve':13A,16A 'data':90C 'directori':36B,89C 'escap':43B,114C 'execut':134C,148C 'file':95C 'host':28B 'html':41B,84C,113C 'import':6A,35B,64B,88C,143C 'inject':82C 'lead':144C 'malici':83C 'markup':85C 'omnispac':1A,23B,29B,65C 'omnispace':19A 'payload':52B,128C 'perform':62B,141C 'php':25B 'project':21A,31B,67C 'render':34B,99C,131C 'run':8A,54B 'script':9A,51B,76C,147C 'self':27B 'self-host':26B 'site':75C 'store':3A,72C 'tabl':101C 'text':103C 'txt':109C 'upload':93C 'utf8encode':110C 'valu':39B,97C,105C 'verbatim':132C 'via':5A 'vuepersonsimportexport.php':116C 'vulner':77C 'without':42B 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Organizations running Omnispace Agora Project 26.10.0 or earlier where administrators import directory or CSV data. Exposure depends on someone supplying a malicious CSV or directory entry that an admin then imports. Deployments that do not use the person import feature are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["agoraproject","omnispaceagoraproject"],"ptokens":["agora","omnispace","project"],"labels":["agora","medium","omnispace","other","php","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-63166':15A,18A 'admin':11A 'agora':2A,20A 'browser':12A 'csv':7A 'cve':13A,16A 'import':6A 'omnispac':1A 'omnispace':19A 'project':21A 'run':8A 'script':9A 'store':3A 'via':5A 'xss':4A","search_b":"'26.10.0':33B 'administr':60B 'agora':22B,30B 'browser':57B 'carri':49B 'cell':47B 'craft':45B 'csv':38B,46B 'directori':36B 'escap':43B 'host':28B 'html':41B 'import':35B,64B 'omnispac':23B,29B 'payload':52B 'perform':62B 'php':25B 'project':31B 'render':34B 'run':54B 'script':51B 'self':27B 'self-host':26B 'valu':39B 'without':42B","search_c":"'26.10.0':69C 'administr':140C,151C 'agora':66C 'allow':79C 'arbitrari':146C 'attack':80C,117C 'attribut':106C,126C 'attribute-breakout':125C 'breakout':127C 'browser':137C 'cell':102C,122C 'contain':70C,123C 'context':152C 'control':87C 'craft':119C 'cross':74C 'cross-sit':73C 'csv':94C,121C 'data':90C 'directori':89C 'escap':114C 'execut':134C,148C 'file':95C 'html':84C,113C 'import':88C,143C 'inject':82C 'lead':144C 'malici':83C 'markup':85C 'omnispac':65C 'payload':128C 'perform':141C 'project':67C 'render':99C,131C 'script':76C,147C 'site':75C 'store':72C 'tabl':101C 'text':103C 'txt':109C 'upload':93C 'utf8encode':110C 'valu':97C,105C 'verbatim':132C 'vuepersonsimportexport.php':116C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T17:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63166","severity":null,"published_at":"2026-11-13T17:17:33+00:00","modified_at":"2026-11-13T17:17:33+00:00","first_seen_at":"2026-11-13T17:48:02+00:00","fetched_at":"2026-11-13T17:48:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}