Read the docs
TI-2026-67717 Aliases CVE-2026-105263GHSA-2rmx-qf8h-6p5c

Server-side request forgery in Shaarli admin metadata endpoint

Priority LOW 23CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Shaarli versions 0.16.0, 0.16.1, 0.16.2 and 0.16.3 are affected. Manipulating the url argument of the MetadataController function causes server-side request forgery (CWE-918). A remote attacker with high privileges can trigger the server to send requests to destinations the attacker chooses.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00232 14th percentileScored 2026-11-07
Fix Fixed Shaarli: 0.16.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Shaarli0.16.0; 0.16.1; 0.16.2; 0.16.30.16.4Patch availableCNA
  • Shaarli Vendor— Affected 0.16.0; 0.16.1; 0.16.2; 0.16.3 Fixed in 0.16.4 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:shaarli:shaarli:*:*:*:*:*:*:*:*——shaarli
  • cpe:2.3:a:shaarli:shaarli:*:*:*:*:*:*:*:* Versions — — ·shaarli

Remediation

Upgrade Shaarli to version 0.16.4, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Shaarli Fixed in 0.16.4

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-105263
  2. 2026-10-05 Alias added: GHSA-2rmx-qf8h-6p5c

References

Patch 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences