PT-2026-50536 · Shaarli · Shaarli

Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-48823

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shaarli versions prior to 0.16.2

Description A stored Cross-Site Scripting (XSS) issue exists in the tag filtering functionality. An authenticated user can inject arbitrary JavaScript into the tags field when creating a bookmark. Because user-supplied input in the tags field is not properly sanitized or output-escaped, the malicious payload is stored in the database and executed when users, including administrators and privileged users, interact with the "Filter by tag" search feature on the homepage. The application renders matching tags dynamically, allowing HTML with JavaScript event handlers to be injected into the DOM.

Recommendations Update to version 0.16.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-48823

Affected Products

Shaarli

References · 4

• https://github.com/shaarli/Shaarli/releases/tag/v0.16.2 · Note
• https://github.com/shaarli/Shaarli/security/advisories/GHSA-68qr-fvv8-6mc6 · Note
• https://twitter.com/VulmonFeeds/status/2067394338389180882 · Twitter Post
• https://twitter.com/CVEnew/status/2067350969407422561 · Twitter Post