---
id: "CVE-2026-63166"
page: "https://infrastack.ai/live/CVE-2026-63166"
kind: "vulnerability"
aliases: ["CVE-2026-63166"]
title: "Omnispace Agora: stored XSS via imported CSV runs script in admin browsers"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Omnispace Agora Project", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["agora", "omnispace", "other", "php", "self-hosted"]
not_affected_if: ["auth-required", "no-csv-import"]
published_at: "2026-11-13T17:17:33+00:00"
first_seen_at: "2026-11-13T17:48:02+00:00"
updated_at: "2026-11-13T17:49:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63166", "first_seen_at": "2026-11-13T17:48:02+00:00"}]
exploit_sources: []
---

# Omnispace Agora: stored XSS via imported CSV runs script in admin browsers

Link for people: https://infrastack.ai/live/CVE-2026-63166 (this .md is for agents)

Omnispace Agora Project through 26.10.0 renders imported directory and CSV values into HTML without escaping. A crafted CSV cell can carry a script payload that runs in the browser of the administrator who performs the import.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Omnispace Agora Project affected range not listed fixed no fixed version listed

## How to check

- Check whether your deployment runs Omnispace Agora Project at version `26.10.0` or earlier.
- Look for the file `VuePersonsImportExport.php` in the installation.

## Timeline

- 2026-11-13T17:48:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63166

## From the sources

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_