6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-29746

CVE-2025-29746: Koillection Cross Site Scripting vulnerability

Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-29746

CVE-2025-29746:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
koillection/koillection	composer	< 1.6.12	1.6.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis focused on two primary commits (6914f8b4c0c349ca9e7dc07cbbd89a76815682f2 and c8434fd74f04506ef4237743f9e2c9d7e9d8f5b0) that explicitly mentioned fixing XSS vulnerabilities. The changes within these commits were examined to identify functions where data handling was modified to prevent XSS.

For JavaScript files, functions involved in dynamic HTML generation (e.g., creating 'chips' for tags, rendering select options) were identified. The patches showed a shift from string concatenation to safer DOM manipulation methods like document.createElement and textContent.

For PHP files (Twig extensions/runtimes), functions responsible for preparing data for rendering in templates were scrutinized. Changes included adding htmlspecialchars to escape data and removing a custom 'safeContent' filter that bypassed Twig's auto-escaping. The way data (like tags and log messages) was passed to templates and rendered was also altered to ensure proper escaping.

The identified functions were directly involved in processing or rendering user-influenced data (like tag names, item labels, selected values, log entry details) in a way that was vulnerable to XSS before the patches. The vulnerability description mentioning 'collection, Wishlist and album components' aligns with the general nature of the patched functions (tagging, selection, data display, logging) which would be used across these application components.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.