Server-Side Request Forgery in Shaarli Affects Multiple Versions

CVE-2026-110225

What is CVE-2026-110225?

Shaarli versions up to 0.16.9 contain a serious vulnerability that enables authenticated users to exploit server-side request forgery (SSRF). This flaw allows users to construct bookmarks that trigger internal server requests to private addresses, including loopback and cloud metadata endpoints. Through the ThumbnailsController, attackers can execute blind GET requests by fetching bookmark thumbnails without proper checks on private addresses. The vulnerability is exacerbated by the open_shaarli configuration, which exposes this attack vector to any visitors. For detailed advisory and the potential impact of this flaw, please refer to the external security assessments.

References