Vulnerabilities

TI-2026-73442 CVE-2026-110225 · GHSA-w44p-6p6v-f82x

Server-side request forgery in Shaarli thumbnail retrieval

MEDIUM 56

Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00342 Published 2026-10-13 No fix listed CWE-918

TI-2026-36949 CVE-2026-50190

Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page

HIGH 72

Shaarli is a personal bookmarking service.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00436 Published 2026-08-20 Fixed in 0.16.3 CWE-79

TI-2026-36090 CVE-2026-48821

Shaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail Synchronizer

LOW 25

Shaarli is a personal bookmarking service.

CVSS 3.1MEDIUM 5.8 Local High privileges User interaction EPSS 0.0013 Published 2026-06-17 Fixed in 0.16.2 CWE-79

TI-2026-36092 CVE-2026-48823

Shaarli has Stored Cross-Site Scripting (XSS) via Tags Search

MEDIUM 55

Shaarli is a personal bookmarking service.

CVSS 3.1MEDIUM 4.8 Local High privileges User interaction EPSS 0.00115 Published 2026-06-17 Fixed in 0.16.2 CWE-79

TI-2026-36091 CVE-2026-48822

Shaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links

MEDIUM 61

Shaarli is a personal bookmarking service.

CVSS 3.1MEDIUM 5.8 Local High privileges User interaction EPSS 0.0012 Published 2026-06-17 Fixed in 0.16.2 CWE-79

TI-2025-34947 CVE-2025-55291

Shaarli allows reflected XSS via searchtags parameter

MEDIUM 64

Shaarli is a minimalist bookmark manager and link sharing service.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00248 Published 2025-08-18 Fixed in 0.15.0 CWE-79

Vulnerabilities

Filters

Server-side request forgery in Shaarli thumbnail retrieval

Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page

Shaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail Synchronizer

Shaarli has Stored Cross-Site Scripting (XSS) via Tags Search

Shaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links

Shaarli allows reflected XSS via searchtags parameter