CVE-2025-49588
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Linkwarden, a self-hosted bookmark manager, in version 2.10.2 accepts links of format file:///etc/passwd and does not perform any validation before sending them to parsers and playwright. This can result in leakage of other users' links and, in some cases, leakage of environment secrets. The issue is fixed in version 2.10.3.
Risk Assessment
An attacker could access other users' private bookmarks or environment secrets, causing a serious confidentiality breach. The risk affects multi-user Linkwarden instances.
Recommendation
Update Linkwarden to version 2.10.3. Until then, consider restricting the ability to add file:// links or implementing additional input validation.
Other vulnerabilities in Linkwarden
See all- CVE-2026-44313Critical
Linkwarden prior to version 2.13.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function. Authenticated users can make arbitrary HTTP requests to internal services due to insufficient URL validation.
- CVE-2026-42455High
Linkwarden versions 2.14.0 and earlier do not sanitize HTML files uploaded as archives. The endpoint /api/v1/archives/[linkId]?format=4 accepts HTML files with JavaScript, which is then served from the same origin without a Content-Security-Policy header. This allows arbitrary JavaScript execution in the context of an authenticated user session.
Original NVD description (English source)
Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links of format file:///etc/passwd and doesn't do any validation before sending them to parsers and playwright, this can result in leak of other user's links (and in some cases it might be possible to leak environment secrets). This issue has been patched in version 2.10.3 which has not been made public at time of publication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS