Stored Cross-Site Scripting Vulnerability in LinkAce by Kovah

CVE-2025-59424

What is CVE-2025-59424?

LinkAce, a self-hosted archive for collecting website links, is subject to a Stored Cross-Site Scripting (XSS) vulnerability. This issue arises on the /system/audit page, where the application improperly sanitizes input from the username field before rendering it in the audit log. An authenticated attacker can exploit this vulnerability by entering a malicious JavaScript payload as their username. When actions associated with this user are recorded—such as generating or revoking an API token—the harmful script is stored within the database. Later, whenever any user, particularly administrators, accesses the /system/audit page, the script is executed in their browser, posing a significant security risk. The vulnerability has been addressed in version 2.3.1 of LinkAce.

References