Stored Cross-Site Scripting in LinkAce by Kovah

CVE-2025-53838

What is CVE-2025-53838?

A stored cross-site scripting vulnerability has been identified in LinkAce, a self-hosted link archiving application. This vulnerability allows attackers to inject malicious JavaScript code that gets executed in a user’s browser when they click on a crafted link. The issue arises from inadequate filtering and escaping of user-supplied data within link attributes, enabling the insertion of harmful scripts into the database. The vulnerability is mitigated in version 2.1.9, which addresses the problem and enhances overall security.

References