PT-2025-45057 · Linkace · Linkace

Published 2025-11-04 · Updated 2025-11-05 · CVE-2025-62722

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LinkAce versions 2.3.1 and below

Description LinkAce is a self-hosted archive to collect website links. The social media sharing functionality contains a Stored Cross-Site Scripting (XSS) issue that allows an authenticated user to inject arbitrary JavaScript by creating a link with malicious HTML in the title field. When a user views the link details page and the shareable links are rendered, the malicious JavaScript executes in their browser. This can be exploited to steal session cookies, perform actions on behalf of users, or deliver malware. The vulnerability is present in the rendering of shareable links.

Recommendations LinkAce versions prior to 2.4.0 should be updated to version 2.4.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-02095

CVE-2025-62722

GHSA-4MXH-7C7F-Q79J

Affected Products

Linkace

References · 8

• 🔥 https://github.com/Kovah/LinkAce/security/advisories/GHSA-4mxh-7c7f-q79j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62722.json · Exploit
• https://github.com/Kovah/LinkAce/commit/95d29b71ad9d4750cff8bbe7488802f6a4afa6aa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62722 · Security Note
• https://bdu.fstec.ru/vul/2026-02095 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62722 · Vendor Advisory
• https://github.com/Kovah/LinkAce/releases/tag/v2.4.0 · Note
• https://t.me/CVEtracker/36570 · Telegram Post