Cross-site scripting in Shaarli - CVE-2026-48821
Published: May 25, 2026
Vulnerability identifier: #VU132254
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-48821
CWE-ID: CWE-79
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to execute arbitrary JavaScript in the administrator's browser.
The vulnerability exists due to cross-site scripting in the Thumbnail Synchronizer feature when rendering bookmark titles returned by the thumbnail update process. A local privileged user can create a bookmark with a crafted title to execute arbitrary JavaScript in the administrator's browser.
User interaction is required to run the thumbnail synchronization feature, and the issue is triggered when the progress interface renders the returned title using innerHTML.
Affected software
Shaarli
How to mitigate CVE-2026-48821
Install security update from vendor's website.
Shaarli - update to 0.16.2