CVE-2026-49436 in LinkAce
Summary
by MITRE • 08/21/2026
LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format validation, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered verbatim as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser — exfiltrating cookies and session tokens. Version 2.5.7 fixes the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in LinkAce prior to version 2.5.7 represents a classic Stored Cross-Site Scripting (XSS) flaw rooted in insufficient input validation at the API layer combined with unsafe output rendering. As a self-hosted solution for collecting and organizing website links, LinkAce relies heavily on user-provided data being displayed back to users within its web interface. The specific attack vector targets the Bulk Link API endpoint located at POST /api/v2/bulk/links. This endpoint is designed to accept multiple URLs in a single request to facilitate efficient bulk operations. However, prior to the patched version, this endpoint failed to enforce strict format validation on the submitted URL strings. Consequently, an authenticated user could submit a malicious payload disguised as a Uniform Resource Identifier, specifically utilizing the javascript: URI scheme rather than standard protocols like http or https.
The core technical flaw lies in the lack of sanitization and encoding during both input processing and output rendering. When a user submits a link containing a javascript: prefix, the application stores this value directly into its database without stripping dangerous characters or validating that the string conforms to expected URL structures. Later, when the stored links are displayed within Blade templates, which serve as the view layer for the Laravel-based application, these values are rendered verbatim as href attributes in HTML anchor tags. Because modern web browsers interpret javascript: URIs as executable scripts rather than navigational targets, clicking on such a link triggers immediate execution of the embedded JavaScript code within the context of the victim's browser session. This behavior bypasses standard same-origin policy protections because the script executes with the privileges and permissions associated with the LinkAce domain where the user is currently logged in.
The operational impact of this vulnerability is significant for any deployment relying on authenticated access to manage link collections. An attacker who has obtained valid credentials, or an insider threat actor within a shared environment, can craft malicious links that, when clicked by other users, execute arbitrary JavaScript code. This execution context allows the attacker to perform session hijacking attacks by exfiltrating sensitive cookies and authentication tokens stored in the browser's local storage or cookie jar. With these credentials, the attacker could impersonate legitimate users, access private archives, modify link collections, or potentially escalate privileges if other vulnerabilities exist within the application logic. Furthermore, because the payload is stored server-side, it remains persistent until manually removed from the database, meaning every user who views the affected page becomes a potential victim without needing to interact with external malicious sites directly.
This vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it falls under Stored XSS where the malicious script is permanently stored on the target server and served to users later. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior maps to T1059 Command and Control scripting techniques, particularly JavaScript execution within a browser environment, and can facilitate credential access through cookie theft which relates to T1539 Steal Web Session Cookie. The failure occurs at the input validation stage (CWE-20) where expected data formats are not enforced, leading to unsafe output encoding in the presentation layer.
To mitigate this vulnerability, organizations running LinkAce must immediately upgrade to version 2.5.7 or later, as these versions implement proper sanitization and escaping mechanisms for user-supplied input before storage and rendering. For environments that cannot be updated instantly due to operational constraints, temporary mitigations include implementing a Web Application Firewall rule set designed to detect and block javascript: URI schemes in POST requests targeting the bulk links endpoint. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact by restricting script execution sources, although this is not a complete fix since the attack vector relies on user interaction with stored content rather than external script loading. Regular security audits of API endpoints to ensure rigorous input validation against expected data types and formats are essential for preventing similar flaws in future development cycles.