Shaarli
CVE-2026-48821
MEDIUM
Severity by source
AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
AV:N reflects the web application delivery; AC:H because attack requires a pre-planted malicious bookmark AND an admin-triggered sync event; PR:H for the required administrative trigger; UI:R as the admin must initiate thumbnail synchronization.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vulnerability in the Thumbnail Synchronizer feature. When an administrator runs the thumbnail update process, malicious bookmark titles are returned via an AJAX response and inserted into the DOM using innerHTML without proper sanitization. The issue originates from the interaction between the backend thumbnail update endpoint and the frontend JavaScript responsible for rendering update progress. On the backend, the ThumbnailsController::ajaxUpdate method returns bookmark data formatted using the 'raw' formatter. This includes the unescaped bookmark title in the JSON response. On the client side, the script thumbnails-update.js processes this AJAX response and dynamically updates the progress interface. Administrators using the thumbnail synchronization feature are affected and exploitation could lead to session hijacking, privilege escalation, backdoor injection and full compromise. This issue has been fixed in version 0.16.2.
AnalysisAI
DOM-based XSS in Shaarli's Thumbnail Synchronizer allows stored malicious bookmark titles to execute arbitrary JavaScript in an administrator's browser session when thumbnail synchronization is triggered. Versions 0.16.1 and prior are affected; the root cause is unsanitized innerHTML injection in thumbnails-update.js after the backend's ThumbnailsController::ajaxUpdate returns raw, unescaped bookmark titles via AJAX. Successful exploitation can lead to session hijacking, privilege escalation, and backdoor injection against administrator accounts. No public exploit or KEV listing is confirmed at time of analysis; a vendor patch is available in v0.16.2.
Technical ContextAI
Shaarli (cpe:2.3:a:shaarli:shaarli:*:*:*:*:*:*:*:*) is a self-hosted PHP bookmarking application. The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) manifests across a client-server boundary: the backend ThumbnailsController::ajaxUpdate endpoint serializes bookmark data using the 'raw' formatter, which performs no HTML encoding on the bookmark title field before embedding it in the JSON response. The frontend script thumbnails-update.js consumes this AJAX payload and injects content into the DOM via innerHTML - a well-known dangerous sink - rather than textContent or a safe DOM manipulation API. Because innerHTML parses HTML markup including script-bearing constructs, any stored bookmark title containing XSS payloads (e.g., <img onerror=...> or <script> tags) is interpreted and executed in the administrator's browser context. This is a stored/persistent DOM-XSS chain: the payload persists in the bookmark store and fires during a specific privileged administrative action.
RemediationAI
The primary fix is to upgrade Shaarli to version 0.16.2, released 2026-05-23, which specifically patches thumbnail update DOM insertions alongside other XSS fixes (Awesomplete autocomplete tag encoding and Markdown href protocol sanitization). The patched release is available at https://github.com/shaarli/Shaarli/releases/tag/v0.16.2. If immediate upgrade is not possible, administrators should avoid running the Thumbnail Synchronizer feature until patched - disabling or restricting access to the thumbnail update AJAX endpoint (/api/thumbnails or equivalent) via web server configuration (e.g., nginx location block deny) is an effective workaround, though it disables thumbnail functionality entirely. As an additional compensating control, Content Security Policy (CSP) headers can be configured on the Shaarli host to block inline script execution, which would mitigate exploitation even if the vulnerable code path is triggered - trade-off is potential breakage of other inline JS in the Shaarli UI. Input sanitization or escaping at the API response layer before the patch is not a trivial code-level workaround without deeper PHP knowledge of Shaarli internals.
Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code
Stored XSS in Shaarli versions before 0.16.0 allows authenticated attackers to inject malicious HTML by crafting tags st
Stored XSS in Shaarli versions prior to 0.16.3 enables administrator account takeover through a low-effort social engine
Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags
Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to injec
Stored XSS in Shaarli's Markdown rendering pipeline (versions 0.16.1 and prior) allows an authenticated user to inject m
Stored XSS in Shaarli's tag filtering functionality permits an authenticated user to inject persistent JavaScript payloa
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today