EUVD-2026-99010
GHSA-w44p-6p6v-f82x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Shaarli (or use open mode)
-
DeliveryCreate bookmark targeting internal/metadata URL
-
ExploitInvoke thumbnail update (ajaxUpdate or save)
-
ExecutionServer sends blind GET to internal host
-
ImpactProbe internal services or cloud metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Default (authenticated) mode: the attacker must be a logged-in Shaarli user able to create or edit bookmarks and trigger the thumbnail-fetch path (ThumbnailsController::ajaxUpdate route or saving a bookmark), which fetches the bookmark URL without validating against loopback, private (RFC 1918), or link-local cloud-metadata ranges. The limiting factor by default is authentication (PR:H in the input vector) and that the SSRF is blind (no response returned to the attacker, only probing/side-effects). This limitation is REMOVED when the open_shaarli configuration setting is enabled, in which case any unauthenticated visitor can trigger the fetch. Real impact is amplified on cloud-hosted deployments where internal metadata endpoints are reachable. |
| Impact | This is a genuine but moderate-priority issue, not a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 5.1 Medium) describes network-reachable, low-complexity exploitation that requires existing privileges (PR:H) and yields only low confidentiality impact (VC:L) with no integrity or availability impact - consistent with a blind SSRF where the attacker triggers server-side requests but does not directly read responses. No EPSS score, CISA KEV listing, or explicit POC flag was provided in the input, so there is no signal of active exploitation; per available data this is 'no public exploit identified at time of analysis,' though a public technical write-up (hackmd) and a VulnCheck advisory describe the mechanism in detail, lowering the barrier to weaponization. A key nuance the CVSS base vector understates: the description states that with the open_shaarli setting enabled, the SSRF is exposed to ANY unauthenticated visitor, which would effectively make PR:N and raise real-world risk for publicly-exposed open-mode instances - verify deployment mode before deprioritizing. Blind SSRF reaching cloud metadata (e.g., 169.254.169.254) can escalate to credential theft on cloud-hosted instances, so impact is environment-dependent rather than uniformly low. |
| Exploit ScenarioDerived | An authenticated Shaarli user (or, if open_shaarli mode is enabled, any anonymous visitor) creates a bookmark whose URL points to an internal resource such as http://169.254.169.254/latest/meta-data/ or a loopback/private address, then triggers thumbnail retrieval via the ThumbnailsController::ajaxUpdate route or by saving the bookmark. The server issues a blind GET request to that internal address, letting the attacker probe internal services or cloud metadata endpoints from the server's network position. A public technical write-up documenting the flaw exists, but no dedicated exploit code was indicated in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Server-side request forgery in Shaarli through 0.16.9 lets a logged-in user force the server to issue blind GET requests to loopback, RFC 1918, or link-local cloud-metadata addresses by creating a bookmark whose URL is fetched for thumbnail generation. The practical barrier is authentication (the supplied CVSS 4.0 vector is PR:H; the independent assessment scores it PR:L under CVSS 3.1), and that barrier disappears when the open_shaarli configuration setting is enabled, at which point any unauthenticated visitor can trigger the fetch. Scoring is moderate (base 5.1, confidentiality-only, no integrity or availability impact) and the effect is blind - no response is returned to the attacker - but real-world risk rises sharply on cloud-hosted instances that can reach internal metadata endpoints; no public exploit code and no CISA KEV entry were identified at time of analysis.
RemediationAI
No vendor-released patch was identified in the available intelligence - 0.16.9 is the newest affected release and no fixed version is named in any supplied reference - so administrators must treat this as an unpatched issue pending an upstream advisory and monitor https://github.com/shaarli/Shaarli for a tagged release. The single highest-value mitigation is to keep open_shaarli disabled (the default); doing so restores the authentication prerequisite and removes the unauthenticated exploitation path, at the cost of anonymous browsing and bookmarking. In addition, enforce outbound egress filtering on the Shaarli host so the PHP process cannot reach 127.0.0.0/8, RFC 1918 ranges, 169.254.169.254, and IPv6 loopback/link-local equivalents; this neutralizes the SSRF even for logged-in users, but may break legitimate thumbnail fetching of internally hosted sites and requires network-layer control the operator may not have on shared hosting. Where thumbnails are not business-critical, disable or remove the thumbnail-fetch feature path (ThumbnailsController / Thumbnailer) and avoid admin-triggered refreshes of untrusted bookmark URLs. On cloud deployments, require IMDSv2 (token-based AWS metadata) or the equivalent hardening on other providers, since a blind tokenless GET cannot retrieve credentials; note this protects only the metadata endpoint, not other internal services. Finally, restrict who can create or edit bookmarks and review existing bookmarks for entries pointing at internal, loopback, or metadata addresses.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Shaarli is a self-hosted PHP bookmark manager that renders preview thumbnails for the URLs users save. The vulnerable path lives in application/Thumbnailer.php (referenced lines 82-98 at commit bfeadb4e5856702c05279bb2a5c405f2ed802015), where the thumbnail fetch routine requests the user-supplied bookmark URL, and in application/front/controller/admin/ThumbnailsController.php (lines 46-64), which exposes the ajaxUpdate route for refreshing an existing thumbnail. Neither path validates the target host against loopback (127.0.0.0/8, ::1), private RFC 1918 ranges, or the link-local metadata range 169.254.169.254, which is the classic CWE-918 root cause: server-side resource fetching driven by attacker-controlled input without a network-position allow/deny list. Because the request is blind, an attacker does not read the response; instead they observe timing, error, or side-effect signals, which is sufficient to port-scan internal hosts or confirm reachability of service endpoints and cloud instance metadata. The open_shaarli setting, intended to allow anonymous browsing and bookmarking, removes the authentication gate entirely and turns the flaw into an unauthenticated SSRF primitive on deployments that enable it.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable, low-complexity SSRF needing a bookmark-creating account (PR:L, or PR:N under open_shaarli); blind requests give limited confidentiality (C:L), no integrity/availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB