CVE-2026-48821
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk3th percentile — higher than 3% of all known CVEs
Summary
Shaarli is a personal bookmarking service that versions 0.16.1 and prior contain a Cross-Site Scripting (XSS) vulnerability in the Thumbnail Synchronizer feature. The issue arises from malicious bookmark titles being returned via an AJAX response and inserted into the DOM without proper sanitization.
Risk Assessment
Exploitation of this vulnerability could lead to session hijacking, privilege escalation, backdoor injection, and full system compromise. Administrators using the thumbnail synchronization feature are directly affected.
Recommendation
It is recommended to upgrade to version 0.16.2, where the issue has been fixed. Additionally, implementing further security measures to minimize XSS risks is advisable.
Original NVD description (English source)
Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vulnerability in the Thumbnail Synchronizer feature. When an administrator runs the thumbnail update process, malicious bookmark titles are returned via an AJAX response and inserted into the DOM using innerHTML without proper sanitization. The issue originates from the interaction between the backend thumbnail update endpoint and the frontend JavaScript responsible for rendering update progress. On the backend, the ThumbnailsController::ajaxUpdate method returns bookmark data formatted using the 'raw' formatter. This includes the unescaped bookmark title in the JSON response. On the client side, the script thumbnails-update.js processes this AJAX response and dynamically updates the progress interface. Administrators using the thumbnail synchronization feature are affected and exploitation could lead to session hijacking, privilege escalation, backdoor injection and full compromise. This issue has been fixed in version 0.16.2.