CVE-2026-116052
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A cross-site request forgery (CSRF) vulnerability has been discovered in LinkStackOrg LinkStack up to version 4.8.8, affecting an unknown function. The attack can be exploited remotely, and the vendor did not respond to the disclosure.
Risk Assessment
An attacker could trick a logged-in user into unknowingly performing unwanted actions in the application, potentially leading to data or account configuration changes.
Recommendation
Update LinkStack to the latest version as soon as it becomes available and implement CSRF protections such as anti-CSRF tokens and SameSite cookie attributes.
Other vulnerabilities in LinkStack
See all- CVE-2025-69904Medium
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.
- CVE-2026-7502Medium
A vulnerability was detected in LinkStackOrg LinkStack up to 4.8.6 in the saveLink function of the file app/Http/Controllers/UserController.php (Management Endpoint component). The manipulation leads to authorization bypass. The attack can be initiated remotely and the exploit is public; the fixing pull request awaits acceptance.
- CVE-2026-7501Low
A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. It affects the editPage function in app/Http/Controllers/UserController.php. Manipulation of the pageDescription argument can lead to cross site scripting, and the attack can be launched remotely.
Original NVD description (English source)
A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS