CVE-2026-50190 in Shaarli
Summary
by MITRE • 08/20/2026
Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark->getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `<title>` element without HTML escaping. A bookmark title containing `</title><script>...</script>` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli's metadata fetcher copies a remote page's `<title>` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
Shaarli is a self-hosted personal bookmarking service that allows users to collect, organize, and share web links. In versions prior to 0.16.3, the application contains a critical stored cross-site scripting vulnerability located within the BookmarkListController component. This flaw arises from improper neutralization of user input before it is placed into an HTML context, specifically affecting how bookmark titles are rendered in the document header. The security issue stems from the permalink handler which directly concatenates the raw title retrieved via `$bookmark->getTitle()` into the `pagetitle` template variable without applying any form of HTML escaping or encoding. When the RainTPL engine processes this data, it injects the unescaped content directly into the `<title>` element of the generated HTML document structure.
The operational impact of this vulnerability is severe because it enables a stored cross-site scripting attack that can lead to complete account compromise for administrators and session hijacking for regular users. An attacker who controls an external web page can craft its title tag to include malicious JavaScript code, such as `</title><script>...payload...</script>`. When a Shaarli user bookmarks this URL using the built-in metadata fetcher, the application automatically retrieves the remote page's title and stores it verbatim in the local database. This action effectively plants the XSS payload within the Shaarli instance without requiring any further interaction from the victim beyond clicking the bookmark link.
The exploitation chain becomes particularly dangerous when an administrator bookmarks such a malicious URL. Because the stored payload is executed every time a user visits the permalink page for that specific bookmark, it provides a persistent vector for attack. For administrators, this results in a one-shot account takeover as the injected script executes within the context of the Shaarli origin. This allows attackers to steal session cookies, perform actions on behalf of the administrator, or redirect users to phishing sites. The vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation known commonly as Cross-site Scripting. It also aligns with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter subcategories related to JavaScript execution in browser contexts.
To mitigate this vulnerability, organizations running Shaarli must upgrade immediately to version 0.16.3 or later where the issue has been resolved by implementing proper output encoding for template variables. Until an upgrade is possible, administrators should avoid bookmarking URLs from untrusted sources and consider restricting who can create bookmarks if the platform allows public contributions. Additionally, deploying a Web Application Firewall with rules capable of detecting script injection in title fields may provide temporary protection against exploitation attempts while patch management procedures are executed.