EUVD-2026-63686Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Network API, low-privilege submission, victim click required, session hijack yields high C/I; scope unchanged, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (POST /api/v2/bulk/links) accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser - exfiltrating cookies and session tokens. Version 2.5.7 fixes the issue.
AnalysisAI
Stored XSS in LinkAce's Bulk Link API allows any authenticated user to persist a javascript: URI that executes arbitrary JavaScript in a victim's browser when they click the stored link. All LinkAce instances prior to version 2.5.7 are affected via the POST /api/v2/bulk/links endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated user account on the target LinkAce instance - the CVSS PR:L vector confirms that standard (low-privilege) authenticated access is sufficient; no administrative role is needed to submit links via the Bulk API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) is well-calibrated for this vulnerability: network-reachable, low complexity, low privilege to inject, but requiring victim interaction to trigger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade LinkAce to version 2.5.7 or later, which adds Laravel's built-in 'url' validation rule to BulkStoreLinksRequest.php, rejecting javascript: and other non-HTTP/HTTPS schemes before persistence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all LinkAce deployments and identify instances running versions prior to 2.5.7. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
LinkAce is a self-hosted archive to collect website links. Rated high severity (CVSS 8.4), this vulnerability is remotel
LinkAce is a self-hosted archive to collect links of your favorite websites. Rated high severity (CVSS 7.6), this vulner
LinkAce is a self-hosted archive to collect website links. Rated high severity (CVSS 7.3), this vulnerability is remotel
Stored XSS in LinkAce 2.4.2 and below allows authenticated users to inject malicious JavaScript through improperly sanit
LinkAce is a self-hosted archive to collect links of your favorite websites. Rated medium severity (CVSS 5.4), this vuln
Stored cross-site scripting in LinkAce prior to 2.5.6 allows a low-privilege OAuth-authenticated user to plant a persist
Server-Side Request Forgery (SSRF) in LinkAce self-hosted link archival application allows authenticated users to bypass
Remote code execution in LinkAce self-hosted link archive versions prior to 2.5.6 allows unauthenticated remote attacker
Password reset poisoning in LinkAce (self-hosted link archive by Kovah) before 2.5.4 allows a remote attacker to hijack
Server-side request forgery in LinkAce allows authenticated users to make arbitrary HTTP requests to internal network ad
Cross-tenant resource tampering in LinkAce before 2.5.6 lets any authenticated user modify links, lists, tags, and notes
LinkAce versions before 2.5.3 disclose private notes to authenticated users via the web interface when viewing shared li
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today