Cross-site scripting in Shaarli
Priority LOW 32CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML via the URL to the (1) showRSS, (2) showATOM, or (3) showDailyRSS function; a (4) file name to the importFile function; or (5) vectors related to bookmarks.
Why it matters now
EPSS 0.02212 82nd percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed Shaarli (Shaarli): 53da201749f8f362323ef278bf338f1d9f7a925a
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| shaarli | Shaarli | before 53da201749f8f362323ef278bf338f1d9f7a925a | 53da201749f8f362323ef278bf338f1d9f7a925a | Patch available | CNA |
- Shaarli Vendorshaarli Affected before 53da201749f8f362323ef278bf338f1d9f7a925a Fixed in 53da201749f8f362323ef278bf338f1d9f7a925a Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:shaarli_project:shaarli:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Shaarli Project |
- cpe:2.3:a:shaarli_project:shaarli:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Shaarli Project
Remediation
- Fix · CNA Shaarli (Shaarli) Fixed in 53da201749f8f362323ef278bf338f1d9f7a925a
Timeline
- 2026-10-02 Threatist record created from CVE-2013-7351
- 2026-10-03 Alias added: GHSA-r2f8-gmp8-xxp8
References
More shaarli vulnerabilities
- TI-2026-36949 Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page CVSS 4.0HIGH 8.6
- TI-2025-34947 Shaarli allows reflected XSS via searchtags parameter CVSS 3.1HIGH 7.1
- TI-2026-36091 Shaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links CVSS 3.1MEDIUM 5.8
- TI-2026-73442 Server-side request forgery in Shaarli thumbnail retrieval CVSS 4.0MEDIUM 5.1
- TI-2026-36092 Shaarli has Stored Cross-Site Scripting (XSS) via Tags Search CVSS 3.1MEDIUM 4.8
- TI-2026-36090 Shaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail Synchronizer CVSS 3.1MEDIUM 5.8
Sources
- CVE-2013-7351 · CVE Program
- CVE-2013-7351 · NVD
- FIRST EPSS
- GHSA-r2f8-gmp8-xxp8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences