Shaarli CVE-2026-48822

Exploitation requires an authenticated session with bookmark creation privileges on the target Shaarli instance - consistent with PR:H in the CVSS vector, reflecting Shaarli's default single-owner design where only the instance administrator can create bookmarks. The Markdown rendering feature must be enabled for bookmark descriptions (the vulnerable code path in BookmarkMarkdownFormatter.php is only exercised when Markdown processing is active). A second user interaction is required: a victim - any user or guest - must load the page containing the crafted bookmark description (UI:R). The specific bypass requires use of Markdown reference-style link syntax rather than inline links, because the filterProtocols regex exclusively targets inline syntax. Exploitation is therefore bounded by: (1) attacker control of a high-privilege Shaarli account or successful compromise of one, and (2) Markdown plugin being active. Instances that have disabled Markdown rendering or restricted all access to a single trusted operator are not exploitable via this path.

The NVD-assigned CVSS base score of 5.8 uses the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N. The AV:L (local attack vector) metric is inconsistent with a network-accessible web application and appears to be a classification error - independent assessment yields AV:N. PR:H (high privileges required) is plausible given Shaarli's default single-owner design where only the instance administrator creates bookmarks, though multi-user configurations could lower this to PR:L. S:U (no scope change) in the provided vector is also questionable for a stored XSS that executes in a victim's browser context, suggesting S:C is more accurate. No EPSS data was supplied, no CISA KEV listing was indicated, and no public POC exploit has been identified at time of analysis. For self-hosted single-user deployments the practical risk is constrained - the attacker must first hold or compromise the owner account - but for public or multi-user Shaarli instances the stored XSS represents a meaningful threat to any visitor.

An attacker authenticated as a Shaarli administrator creates a bookmark whose description contains a Markdown reference-style link - for example, [click here][ref] paired with a separate line [ref]: javascript:alert(document.cookie) - which passes through the filterProtocols sanitization undetected. When any user or unauthenticated guest loads the bookmark listing or detail page, the Markdown parser resolves the reference and renders a javascript: anchor that executes in the viewer's browser, delivering the attacker's payload. No public proof-of-concept code has been confirmed at time of analysis, but the vulnerability is straightforward to reproduce given the published description and patch diff.