What is the CVSS score of CVE-2026-48822?

CVE-2026-48822 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Shaarli CVE-2026-48822

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 GitHub_M

PHP XSS Shaarli

5.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.8 MEDIUM

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-accessible web application warrants AV:N over AV:L; S:C applies as injected script executes in victim's browser; PR:H reflects Shaarli's default single-owner bookmark creation model.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 20:34 vuln.today

Analysis Generated

Jun 17, 2026 - 20:34 vuln.today

DescriptionCVE.org

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversion process used in the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown link. The vulnerability originates in the filterProtocols method within BookmarkMarkdownFormatter.php.This method attempts to sanitize Markdown links by filtering dangerous protocols (such as javascript:) before rendering. It uses the following regular expression: (#]\((.*?)\)#is). This regex is designed to detect inline Markdown links, but it fails to detect Markdown reference-style links because reference-style links are resolved by the Markdown parser after preprocessing. The filterProtocols method never inspects the actual URL used in these references and as a result, an attacker can supply a javascript: URI inside a reference definition. This issue has been fixed in version 0.16.2.

AnalysisAI

Stored XSS in Shaarli's Markdown rendering pipeline (versions 0.16.1 and prior) allows an authenticated user to inject malicious javascript: URIs via Markdown reference-style links in bookmark descriptions, bypassing the filterProtocols sanitization method in BookmarkMarkdownFormatter.php. When any user or guest visitor views the crafted bookmark, arbitrary JavaScript executes in their browser context, enabling session theft or unauthorized actions. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV; vendor-released patch v0.16.2 is available as of 2026-05-23.

Technical ContextAI

Shaarli (CPE: cpe:2.3:a:shaarli:shaarli:*:*:*:*:*:*:*:*) is a PHP-based self-hosted personal bookmarking service. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) lies in the filterProtocols method of BookmarkMarkdownFormatter.php, which uses the regex (#]\((.*?)\)#is) to detect and strip dangerous protocols such as javascript: from Markdown links before rendering. This pattern only matches inline Markdown link syntax ([text](url)) and is completely blind to reference-style Markdown links ([text][ref] paired with a separate [ref]: url definition). Because the Markdown parser resolves reference definitions after filterProtocols has already run, a javascript: URI embedded in a reference definition is never inspected by the sanitizer and passes through to the rendered HTML as a functional anchor tag.

RemediationAI

Upgrade to Shaarli v0.16.2, released 2026-05-23, which patches the filterProtocols method to handle Markdown reference-style link definitions and also addresses two additional XSS vectors: encoding of tag text in Awesomplete autocomplete suggestions and sanitization of thumbnail update DOM insertions (see https://github.com/shaarli/Shaarli/releases/tag/v0.16.2 and advisory GHSA-2hgr-63wv-x462). If an immediate upgrade is not feasible, disabling the Markdown plugin for bookmark descriptions eliminates the vulnerable code path entirely - this is the most effective compensating control, though it removes Markdown formatting functionality for all descriptions. Restricting bookmark creation to a single trusted administrator and disabling public/guest access to the instance reduces the attack surface but does not eliminate risk if the admin account is compromised.