CVE-2026-42455

HighCVSS 8.8

Published: 09/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

37th percentile - higher than 37% of all known CVEs

Summary

Linkwarden versions 2.14.0 and earlier do not sanitize HTML files uploaded as archives. The endpoint /api/v1/archives/[linkId]?format=4 accepts HTML files with JavaScript, which is then served from the same origin without a Content-Security-Policy header. This allows arbitrary JavaScript execution in the context of an authenticated user session.

Risk Assessment

An attacker can execute arbitrary scripts in the victim's browser, stealing sessions, data, or performing actions on behalf of the user. No patches are publicly available at the time of publication.

Recommendation

Restrict access to the archive endpoint, implement custom CSP headers, or temporarily disable HTML archive uploads until a patch is released.

Other vulnerabilities in Linkwarden

CVE-2026-44313Critical
Linkwarden prior to version 2.13.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function. Authenticated users can make arbitrary HTTP requests to internal services due to insufficient URL validation.

Original NVD description (English source)

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In versions 2.14.0 and prior, the archive upload endpoint (POST /api/v1/archives/[linkId]?format=4) accepts HTML files (text/html) without sanitizing JavaScript content. When the archive is later accessed via GET /api/v1/archives/[linkId]?format=4, the HTML is served with Content-Type: text/html from the Linkwarden origin, without any Content-Security-Policy header. This allows arbitrary JavaScript execution in the context of the authenticated Linkwarden sessio. At time of publication, there are no publicly available patches.