CVE-2026-50888

Packagist/koillection/koillection CVE-2026-50888: high 8.1, EPSS 0.35%

Koillection has an authenticated Server-Side Request Forgery issue

Action: Upgrade koillection/koillection to 1.8.4 or later.

composer require koillection/koillection:1.8.4

Affected

Fixed versions

Sources

• osv: GHSA-gmxh-hjfv-qc2w
• https://nvd.nist.gov/vuln/detail/CVE-2026-50888
• https://github.com/benjaminjonard/koillection/pull/1599
• https://github.com/benjaminjonard/koillection/commit/4d445e21c631c26070f19fe8ec086a2939767ae0
• https://gist.github.com/pyuysig/d60273c1c346257ceddbf8da7134bae7
• https://github.com/benjaminjonard/koillection
• https://github.com/benjaminjonard/koillection/releases/tag/1.8.4

CVE-2026-50888 · published 2026-06-15T21:30:41Z · modified 2026-08-27T17:10:37.018291Z · JSON