CVE-2026-105263
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the Admin Metadata Endpoint component. Manipulation of the url argument results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue.
Risk Assessment
The SSRF vulnerability may allow an attacker to make requests on behalf of the server, potentially leading to disclosure of internal resources or attacks on other systems.
Recommendation
It is recommended to immediately upgrade Shaarli to version 0.16.4 or later, which includes the fix.
Other vulnerabilities in Shaarli
See all- CVE-2026-50190High
Shaarli before version 0.16.3 is vulnerable to stored XSS in BookmarkListController.php. The permalink handler concatenates the raw bookmark title into the page title and emits it into the <title> element without HTML escaping. A bookmark title containing </title><script>...</script> can execute a script in the Shaarli origin for any visitor. An attacker can convince an administrator to bookmark a malicious URL, leading to administrator account takeover.
- CVE-2026-48823Medium
Shaarli, a personal bookmarking service, contains a stored XSS vulnerability in the tag filtering functionality in versions 0.16.1 and prior. An authenticated user can inject arbitrary JavaScript into the tags field when creating a bookmark, leading to the storage of a malicious payload in the database.
- CVE-2026-48822Medium
Shaarli is a personal bookmarking service that versions 0.16.1 and prior contain a Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversion process used in the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown link.
Original NVD description (English source)
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS