CVE-2026-105263 in Shaarli
Summary
by MITRE • 10/05/2026
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/05/2026
A critical server-side request forgery vulnerability has been identified in Shaarli, a self-hosted bookmarking and link sharing application, specifically within versions up through 0.16.3. This flaw resides in the MetadataController class located at application/front/controller/admin/MetadataController.php, which serves as part of the Admin Metadata Endpoint component. The vulnerability arises from insufficient validation or sanitization of user-supplied input passed to the url argument during metadata fetching operations. When an attacker provides a maliciously crafted URL payload, the server processes this request and initiates outgoing connections on behalf of the victim application. This behavior allows remote attackers to manipulate internal network resources that would otherwise be inaccessible due to standard security boundaries such as firewalls or access control lists.
The technical nature of this flaw aligns with CWE-918, which defines Server-Side Request Forgery (SSRF) flaws where a web server fetches a specified URL without properly validating the user-supplied input. In the context of Shaarli, an attacker can exploit this by submitting URLs that point to internal services running on localhost or within the private network segment hosting the application. Common targets for such exploitation include cloud metadata endpoints like 169.254.169.254, which often contain sensitive authentication credentials and configuration data in cloud environments. Additionally, attackers may target internal databases, administrative interfaces of other services running on non-standard ports, or even local development servers that might expose debugging information. The ability to initiate these requests remotely means that no prior authentication is necessarily required if the endpoint itself does not enforce strict access controls, although many admin endpoints do require login credentials, which could limit the scope but not eliminate the risk for authenticated users who are compromised via other vectors such as cross-site scripting or credential theft.
The operational impact of this vulnerability extends beyond mere data exfiltration from internal services. By leveraging SSRF, an attacker can potentially perform port scanning to map out the internal network topology and identify live hosts and open ports within the organization's infrastructure. This reconnaissance activity facilitates further lateral movement and deeper penetration into the protected environment. Furthermore, if the Shaarli instance is running with elevated privileges or has access to sensitive configuration files, the SSRF could be chained with other vulnerabilities to achieve remote code execution or complete system compromise. The vulnerability affects the integrity of the application's security posture by allowing an external actor to bypass network-level protections and interact directly with backend services that are not intended for public exposure.
To mitigate this risk, immediate action is required to update Shaarli to version 0.16.4 or later, where the patch identified as commit hash 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2 has been applied. This update addresses the input validation logic within the MetadataController to ensure that only safe and expected URL schemes are processed, typically by enforcing a whitelist of allowed protocols such as http and https while blocking internal IP ranges or reserved address spaces like 10.x.x.x, 192.168.x.x, and 172.16-31.x.x. In addition to upgrading the software, organizations should implement network-level controls such as egress filtering on their web servers to restrict outbound connections to only those domains or IP addresses that are strictly necessary for application functionality. Deploying a Web Application Firewall with SSRF detection capabilities can also provide an additional layer of defense by inspecting outgoing requests for patterns indicative of internal service access attempts. Regular security audits and penetration testing should be conducted to verify the effectiveness of these mitigations and ensure no other similar flaws exist within the codebase, particularly in areas handling external resource fetching or API integrations.