PT-2025-36500 · Linkace · Linkace

Medok228 · Published 2025-09-08 · Updated 2025-09-08 · CVE-2025-53838

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: LinkAce versions prior to 2.1.9

Description: LinkAce is a self-hosted archive to collect website links. A stored cross-site scripting (XSS) vulnerability allows an attacker to inject arbitrary JavaScript, which is then executed in the context of a user's browser when a malicious link is clicked. The application contains a stored XSS vulnerability due to insufficient filtering and escaping of user-supplied data inserted into link attributes. Malicious JavaScript code can be saved in the database along with the link and executed in the user’s browser when clicking the link, leading to arbitrary script execution within the context of the site.

Recommendations: Update LinkAce to version 2.1.9 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-53838

GHSA-VWMX-V9QF-Q656

Affected Products

Linkace

References · 8

• 🔥 https://github.com/Kovah/LinkAce/security/advisories/GHSA-vwmx-v9qf-q656 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53838.json · Exploit
• https://github.com/Kovah/LinkAce/commit/4da467a4b0fbb1650670e603f4449b8a47695631 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-53838 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53838 · Vendor Advisory
• https://twitter.com/CVEnew/status/1965137311819014527 · Twitter Post
• https://t.me/CVEtracker/31988 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1965177337617535138 · Twitter Post