Shaarli CVE-2026-105263

Requires reaching the admin-only endpoint /admin/metadata (MetadataController) with a controllable url argument. Exploitation prerequisites: (1) an authenticated Shaarli administrator session, OR (2) tricking a logged-in admin into triggering the request, which was feasible pre-patch because the endpoint did not validate a CSRF token (the fix adds checkToken plus an &token parameter to the metadata JS call). The pre-patch code only checked that the URL scheme contained the substring 'http' and performed no IP validation, so any http(s) URL resolving to a private/loopback/reserved address was fetched. Limiting factors: PR:H (admin privilege) is the primary constraint; after upgrade to 0.16.4 the new is_safe_url/is_private_ip checks block private, loopback, link-local, and reserved IPv4 targets and fail closed on non-IPv4, substantially narrowing the SSRF surface.

This is a moderate, access-gated SSRF (CWE-918) in Shaarli's Admin Metadata Endpoint. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:L/VI:L/VA:L) scores 5.1 and - critically - specifies PR:H, meaning exploitation requires high (administrator) privileges; the vulnerable MetadataController is an admin-only endpoint and the patch added a CSRF token check (checkToken), confirming the attacker must already be an authenticated admin or must chain this with CSRF/XSS against a logged-in admin. No EPSS score, KEV listing, or public exploit was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: despite the network attack vector, the PR:H requirement and admin-only surface make this a low-priority, defense-in-depth fix rather than an urgent threat - the realistic risk is an authenticated admin (or a tricked admin via CSRF) pivoting to internal services, which the low confidentiality/integrity/availability sub-scores reflect. The main signals are consistent (network-reachable but privilege-gated, limited impact); the chief uncertainty is whether the pre-patch absence of a CSRF token effectively lowered the real-world privilege bar, which would make opportunistic CSRF-driven exploitation plausible against admins with active sessions.

An authenticated Shaarli administrator (or an attacker who lures a logged-in admin to a malicious page, since the vulnerable endpoint lacked a CSRF token before the patch) submits a crafted url parameter to /admin/metadata pointing at an internal address such as http://169.254.169.254/ or http://127.0.0.1. Shaarli's server fetches that URL to extract metadata, letting the attacker probe internal hosts, reach cloud metadata services, or hit non-routable services from the server's trust position. No public exploit code was identified, but the one-parameter trigger and the public patch diff make reproduction straightforward.