Read the docs
TI-2026-73442 Aliases CVE-2026-110225GHSA-w44p-6p6v-f82x

Server-side request forgery in Shaarli thumbnail retrieval

Priority MEDIUM 56CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Shaarli through 0.16.9 contains a server-side request forgery flaw (CWE-918) in which fetching bookmark thumbnails skips private-address checks. An authenticated user with a bookmark can make the server send blind GET requests to loopback, private or cloud metadata addresses, and open_shaarli exposes this to any visitor. The CVSS 4.0 vector marks the attack as network reachable with low complexity, requiring high privileges and no user interaction, with low confidentiality impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00342 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
shaarliShaarliup to 0.16.9—No fix listedCNA
  • Shaarli Vendorshaarli Affected up to 0.16.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Shaarli.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-110225
  2. 2026-10-13 Alias added: GHSA-w44p-6p6v-f82x
  3. 2026-10-26 CISA SSVC decision points changed
  4. 2026-10-26 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 3

  • TI-2026-36949 Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page CVSS 4.0HIGH 8.6
  • TI-2025-34947 Shaarli allows reflected XSS via searchtags parameter CVSS 3.1HIGH 7.1
  • TI-2026-36091 Shaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links CVSS 3.1MEDIUM 5.8
  • TI-2026-36092 Shaarli has Stored Cross-Site Scripting (XSS) via Tags Search CVSS 3.1MEDIUM 4.8
  • TI-2026-36090 Shaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail Synchronizer CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences