CVE-2026-7501
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. It affects the editPage function in app/Http/Controllers/UserController.php. Manipulation of the pageDescription argument can lead to cross site scripting, and the attack can be launched remotely.
Risk Assessment
A public exploit is already available and could be used for attacks. This could lead to malicious script execution in the user's browser.
Recommendation
Apply available mitigations or upgrade to a version containing the fix once available. The project was informed of the problem but has not yet reacted.
Other vulnerabilities in LinkStack
See all- CVE-2026-116052Medium
A cross-site request forgery (CSRF) vulnerability has been discovered in LinkStackOrg LinkStack up to version 4.8.8, affecting an unknown function. The attack can be exploited remotely, and the vendor did not respond to the disclosure.
- CVE-2025-69904Medium
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.
- CVE-2026-7502Medium
A vulnerability was detected in LinkStackOrg LinkStack up to 4.8.6 in the saveLink function of the file app/Http/Controllers/UserController.php (Management Endpoint component). The manipulation leads to authorization bypass. The attack can be initiated remotely and the exploit is public; the fixing pull request awaits acceptance.
Original NVD description (English source)
A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. Impacted is the function editPage of the file app/Http/Controllers/UserController.php. Executing a manipulation of the argument pageDescription can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a pull request but has not reacted yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS