Stored XSS Vulnerability in Shaarli Bookmarking Service
CVE-2026-48822

5.8MEDIUM

Key Information:

Vendor

Shaarli

Status
Shaarli
Vendor
CVE Published:
17 June 2026

What is CVE-2026-48822?

Shaarli, a personal bookmarking service, is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in its Markdown-to-HTML conversion process found in versions 0.16.1 and earlier. This flaw allows authenticated users to inject malicious 'javascript:' URIs within the Bookmark Description field. The issue arises from an inadequate sanitization routine in the filterProtocols method of BookmarkMarkdownFormatter.php, which fails to adequately inspect reference-style Markdown links. Consequently, attackers can exploit this gap to execute harmful scripts. The vulnerability has been addressed in version 0.16.2.

Affected Version(s)

Shaarli < 0.16.2

References

https://github.com/shaarli/Shaarli/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/shaarli/Shaarli/releases/tag/v0.16.2
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.