CVE-2026-48823: Stored XSS in Shaarli Tag Filtering—CVSS 4.8 Medium

Technical summary

CVE-2026-48823 is a stored XSS vulnerability (CWE-79) in Shaarli versions 0.16.1 and prior. The vulnerability exists in the tag filtering functionality where user input from the tags field is neither sanitized during storage nor properly output-encoded when rendered in the dynamic tag search interface on the homepage. An authenticated user can inject HTML and JavaScript into the tags field when creating a Shaare (bookmark). The payload persists in the database and executes client-side when the "Filter by tag" feature dynamically renders matching tags in the DOM, exposing any visitor who interacts with that search feature to session hijacking, credential theft, or other malicious client-side actions.

Business impact

While stored XSS vulnerabilities are typically high-risk, this instance is constrained by its requirement for prior authentication and local attack vector. However, the impact remains significant: attackers with valid credentials can compromise the browsing sessions and accounts of other users, including administrators. In shared or multi-user Shaarli instances, this enables account takeover, privilege escalation (if an admin interacts with a poisoned tag), and theft of sensitive bookmarks or private data. Organizations relying on Shaarli for sensitive bookmark sharing face potential data exfiltration and loss of system integrity.

Affected systems

Shaarli versions 0.16.1 and earlier are affected. The vulnerability is patched in version 0.16.2 and later. Both standard installations and Docker-based deployments are in scope. Any instance where multiple users share access—particularly those hosting private or sensitive bookmarks—should prioritize patching. Self-hosted instances without external network exposure still face risk from internal authenticated users.

Exploitability

Exploitation requires valid Shaarli credentials, limiting the attack surface to authenticated users only. An attacker cannot directly compromise a system remotely via the vulnerability alone; they must first authenticate. Once authenticated, injecting the payload is straightforward—it requires only creating or editing a bookmark with JavaScript in the tags field. The execution is guaranteed when any user (including admins) uses tag filtering on the homepage. The attack requires user interaction (clicking "Filter by tag"), but on active instances this is inevitable and frequent. The CVSS score of 4.8 (MEDIUM) reflects this authentication requirement and local attack vector, though the stored nature of the payload and guaranteed execution upon user interaction elevate practical risk in collaborative environments.

Remediation

Upgrade Shaarli to version 0.16.2 or later immediately. This version includes proper input sanitization and output encoding of tag values in the filtering interface. For instances that cannot be upgraded immediately, restrict user creation privileges to trusted administrators only, and educate users not to click tag filters from untrusted sources. These interim measures do not eliminate risk and should not replace timely patching.

Patch guidance

Verify your installed Shaarli version using the administration dashboard or by checking the `VERSION` file in the root directory. If running 0.16.1 or earlier, upgrade to 0.16.2 as soon as feasible. For Docker deployments, pull the latest official Shaarli image (verify the tag corresponds to version 0.16.2+), or manually rebuild from the patched source. Test tag filtering functionality after upgrade to confirm proper rendering without script execution. Maintain regular backups before patching in case rollback is necessary.

Detection guidance

Search database logs or stored bookmarks for suspicious tag values containing JavaScript keywords (e.g., 'onclick', 'onerror', '<script>', 'javascript:') or HTML event handlers. Monitor web server access logs for patterns suggesting tag-filter interactions after new bookmarks are created. Implement Content Security Policy (CSP) headers on the Shaarli instance to restrict inline script execution even if XSS payloads are rendered. Review audit logs (if available) for unusual bookmark creation activity by low-privileged users. After patching, verify that previously injected payloads no longer execute by attempting to reproduce with historical poisoned tags.

Why prioritize this

Although the CVSS score is MEDIUM and the vulnerability requires authentication, its stored nature and guaranteed execution during routine user activity (tag filtering) make it a practical attack vector in multi-user Shaarli deployments. Administrators should prioritize this patch to prevent account compromise and unauthorized access escalation. The fix is straightforward and low-risk, justifying rapid deployment in most environments.

Risk score, explained

The CVSS v3.1 score of 4.8 reflects a constrained but real threat: the attack vector is local (credentialed access only, AV:L), access complexity is low (AC:L), and privilege escalation is not required from the attacker's perspective (PR:H means high privilege is required to inject, but the victim's privilege is what matters—any user can interact with tags). User interaction is required (UI:R), limiting severity. Confidentiality impact is high (C:H) because session tokens or credentials can be stolen, integrity is low (I:L) because modifications are limited to client-side DOM state, and availability is unaffected (A:N). The stored persistence of the payload and its certain execution during normal use elevates practical exploitability despite the MEDIUM score.

Frequently asked questions