CVE-2026-54165: Dobase Workspace DOM-Based XSS Vulnerability

CVE-2026-54165 Overview

CVE-2026-54165 is a stored Document Object Model (DOM)-based Cross-Site Scripting (XSS) vulnerability [CWE-79] in Dobase, an open-source self-hosted workspace platform. Versions prior to 2026.06.03 allow an authenticated workspace member to store a malicious payload in a file name field within a public shared folder. When any unauthenticated visitor loads the shared image gallery, the payload executes in their browser. The flaw requires only a single click on the public share link. Version 2026.06.03 resolves the issue.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser of any unauthenticated visitor who opens a public Dobase shared-folder link, enabling session theft, phishing, and further client-side compromise.

Affected Products

Dobase versions prior to 2026.06.03
Dobase public shared-folder image gallery component
Dobase public-gallery Stimulus controller

Discovery Timeline

2026-09-11 - CVE-2026-54165 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54165

Vulnerability Analysis

The vulnerability resides in Dobase's public shared-folder image gallery. A file name attribute is fully attacker-controlled and is never sanitized before rendering. The value is round-tripped through an ERB-escaped data-name HTML attribute, decoded back to its raw form via el.dataset.name, and re-injected into the DOM through innerHTML by the public-gallery Stimulus controller. The innerHTML assignment reintroduces the original unsanitized bytes as live HTML, allowing inline event handlers such as onerror to execute.

The global Content-Security-Policy (CSP) header is delivered in report-only mode rather than enforcing mode. Because CSP is not enforced, inline event handlers execute freely. This transforms what could have been a reported violation into an executing XSS. The attack requires no authentication on the victim side, only that the victim clicks the public share link.

Root Cause

The root cause is improper output encoding when reconstructing HTML from a data-* attribute. ERB escaping protects the attribute context, but dataset access returns the decoded raw value. Passing that raw value to innerHTML bypasses all prior escaping. A textContent assignment, or explicit sanitization, would have prevented execution.

Attack Vector

An authenticated workspace member with permission to share a Files folder uploads a file whose name contains an HTML payload, for example an <img> tag with an onerror handler. The member enables public sharing and distributes the link. When any visitor loads the shared image gallery, the public-gallery controller renders the crafted name via innerHTML, triggering script execution in the visitor's browser context. Refer to the GitHub Security Advisory GHSA-m95v-4xq6-grhg for full technical details.

Detection Methods for CVE-2026-54165

Indicators of Compromise

File records in Dobase Files folders whose name field contains HTML tags, angle brackets, or event-handler substrings such as onerror=, onload=, or <script.
Public share links to Files folders created by workspace members shortly before external traffic spikes to /public/ gallery endpoints.
Outbound browser requests from gallery viewers to unfamiliar domains sourced from the Dobase share page origin.

Detection Strategies

Query the Dobase database for file name values matching regex patterns for HTML markup or JavaScript event handlers.
Inspect web server access logs for GET requests to public shared-folder gallery routes correlated with unusual Referer chains or exfiltration endpoints.
Review browser Content-Security-Policy violation reports collected from the report-only endpoint for inline-script violations originating from gallery pages.

Monitoring Recommendations

Enable and centralize CSP violation reporting from Dobase public gallery pages to surface injection attempts.
Alert on creation of new public share links, especially those originating from newly created or low-reputation workspace accounts.
Monitor upload activity for files whose names exceed expected length or contain non-filename characters.

How to Mitigate CVE-2026-54165

Immediate Actions Required

Upgrade Dobase to version 2026.06.03 or later without delay.
Audit all existing public shared folders and inspect stored file names for HTML or JavaScript payloads before re-enabling sharing.
Revoke public share links created by untrusted or unverified workspace members until the environment is patched.

Patch Information

Dobase version 2026.06.03 fixes the vulnerability by sanitizing the file name value before it is rendered in the public-gallery Stimulus controller. Administrators should follow upgrade guidance in the GitHub Security Advisory GHSA-m95v-4xq6-grhg.

Workarounds

Disable the public shared-folder feature until the upgrade to 2026.06.03 is completed.
Switch the global Content-Security-Policy from report-only to enforcing mode and remove unsafe-inline from the script-src directive to block inline onerror execution.
Restrict which workspace members can create public share links to a small set of trusted administrators.

bash

# Configuration example: enforce CSP and block inline handlers on the reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;