CVE-2026-50190 shaarli CVE debrief

Who should care

Defenders responsible for Shaarli instances, administrators, and users who bookmark URLs should be aware of this vulnerability and take necessary actions to protect themselves. They should prioritize patching to version 0.16.3 or later, review bookmarks for suspicious titles, and monitor for unusual activity on Shaarli instances.

Why it matters

CVE-2026-50190 is a stored XSS vulnerability in Shaarli that can lead to administrator account takeover if exploited. Defenders should prioritize patching to version 0.16.3 or later and review bookmarks for suspicious titles.

• An attacker can inject a malicious script, potentially leading to administrator account takeover
• The vulnerability can be exploited by creating a bookmark with a specially crafted title
• The attack requires user interaction, as the victim must visit the permalink of the malicious bookmark

Technical summary

The vulnerability exists in the `BookmarkListController.php` file, where the `permalink` handler concatenates the raw `$bookmark->getTitle()` into the `pagetitle` template variable without HTML escaping. This allows an attacker to inject a malicious script by creating a bookmark with a specially crafted title, potentially leading to administrator account takeover if an administrator bookmarks the malicious URL. The vulnerability can be exploited by creating a bookmark with a specially crafted title, and the attack requires user interaction, as the victim must visit the permalink of the malicious bookmark.

Defensive priority

Defenders should prioritize patching to version 0.16.3 or later and review bookmarks for suspicious titles.

Recommended defensive actions

• Patch Shaarli to version 0.16.3 or later
• Review bookmarks for suspicious titles
• Monitor for unusual activity on Shaarli instances
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the fixed version. Defenders should verify Shaarli instances for exposure, review bookmarks for suspicious titles, and monitor for unusual activity. The vulnerability exists in Shaarli versions prior to 0.16.3, and an attacker can inject a malicious script by creating a bookmark with a specially crafted title. Evidence is limited to public CVE and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.