PT-2026-21363 · Linkace · Linkace

Rvizx · Published 2026-02-21 · Updated 2026-02-21 · CVE-2026-27458

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LinkAce versions 2.4.2 and below

Description LinkAce, a self-hosted archive for website links, is affected by a Stored Cross-site Scripting issue. An authenticated user can inject a payload into a list description via the Atom feed endpoint ('/lists/feed') that escapes the XML CDATA section and injects a native SVG element into the Atom XML document. This allows for the execution of arbitrary JavaScript when the feed URL is visited, without requiring an RSS reader or additional rendering context. The issue arises because list descriptions are output using Blade's raw syntax without sanitization within a CDATA block. Specifically, the sequence ']]>' can be injected to prematurely close the CDATA section, enabling the injection of arbitrary XML/SVG elements that are then parsed and executed by the browser.

Recommendations Update LinkAce to version 2.4.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2026-27458

GHSA-2R9P-95XJ-P583

Affected Products

Linkace

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27458.json · Exploit
• https://github.com/Kovah/LinkAce/security/advisories/GHSA-2r9p-95xj-p583 · Vendor Advisory
• https://github.com/Kovah/LinkAce/commit/eb5ba2abe05177ffa678baac0aa3f9c48b47d2f0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27458 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27458 · Vendor Advisory
• https://twitter.com/CVEnew/status/2025154178046161031 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025124300139667724 · Twitter Post
• https://t.me/CVEtracker/45359 · Telegram Post