Linkwarden vulnerabilities

Linkwarden prior to version 2.13.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function. Authenticated users can make arbitrary HTTP requests to internal services due to insufficient URL validation.

Linkwarden versions 2.14.0 and earlier do not sanitize HTML files uploaded as archives. The endpoint /api/v1/archives/[linkId]?format=4 accepts HTML files with JavaScript, which is then served from the same origin without a Content-Security-Policy header. This allows arbitrary JavaScript execution in the context of an authenticated user session.

Linkwarden, a self-hosted bookmark manager, in version 2.10.2 accepts links of format file:///etc/passwd and does not perform any validation before sending them to parsers and playwright. This can result in leakage of other users' links and, in some cases, leakage of environment secrets. The issue is fixed in version 2.10.3.