CVE-2026-50190

Summary

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark->getTitle() into the pagetitle template variable and the RainTPL template emits it into the document <title> element without HTML escaping. A bookmark title containing </title><script>...</script> closes the document title early and the injected script executes in the Shaarli origin for any visitor of /shaare/{hash}. Shaarli's metadata fetcher copies a remote page's <title> text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.

Affected Software

VendorProductVersion RangeStatus
shaarliShaarli< 0.16.3affected

Weaknesses

  • CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

Additional References

References