Server-Side Request Forgery (SSRF) in Shaarli - #VU140700
Published: August 1, 2026
Vulnerability identifier: #VU140700
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
Shaarli
Shaarli
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information from internal HTTP services.
The vulnerability exists due to server-side request forgery (SSRF) in the /admin/metadata endpoint when fetching a user-supplied URL server-side via cURL. A remote privileged user can send a specially crafted request to disclose sensitive information from internal HTTP services.
Redirects are followed automatically without revalidating the destination, and the JSON response returns the fetched page title and meta description data.
Remediation
Install security update from vendor's website.