SB2026092103 - Cross-site scripting in Shaarli

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092103

SB2026092103 - Cross-site scripting in Shaarli

Published: September 21, 2026

Security Bulletin ID SB2026092103
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a local privileged user to execute arbitrary JavaScript in other users' browsers.

The vulnerability exists due to improper neutralization of input during web page generation in the Picture Wall title rendering of bookmarks when rendering a stored bookmark title on the Picture Wall page. A local privileged user can save a bookmark containing a crafted title to execute arbitrary JavaScript in other users' browsers.

Only bookmarks with generated thumbnails are displayed in the Picture Wall.


Remediation

Install update from vendor's website.

References