PT-2026-50535 · Shaarli · Shaarli

Published 2026-06-17 · Updated 2026-06-18 · CVE-2026-48822

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shaarli versions prior to 0.16.2

Description A stored Cross-Site Scripting (XSS) issue exists in the Markdown-to-HTML conversion process used in the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown reference-style link. The problem occurs in the filterProtocols() function within BookmarkMarkdownFormatter.php, which uses a regular expression to sanitize links. This regex fails to detect reference-style links because they are resolved by the Markdown parser after preprocessing, allowing the filterProtocols() function to bypass the inspection of the actual URL used in these references.

Recommendations Update to version 0.16.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-48822

Affected Products

Shaarli

References · 4

• https://github.com/shaarli/Shaarli/releases/tag/v0.16.2 · Note
• https://github.com/shaarli/Shaarli/security/advisories/GHSA-2hgr-63wv-x462 · Note
• https://twitter.com/VulmonFeeds/status/2067396898105745535 · Twitter Post
• https://twitter.com/CVEnew/status/2067350973983367312 · Twitter Post