CVE-2026-48821

Name of the Vulnerable Software and Affected Versions Shaarli versions prior to 0.16.2

Description A DOM-based Cross-Site Scripting (XSS) issue exists in the Thumbnail Synchronizer feature. When an administrator executes the thumbnail update process, malicious bookmark titles are returned via an AJAX response and inserted into the Document Object Model (DOM) using innerHTML without proper sanitization. This occurs because the ThumbnailsController::ajaxUpdate() method returns bookmark data using the 'raw' formatter, which includes unescaped titles in the JSON response. The client-side script thumbnails-update.js then processes this response to update the progress interface. Exploitation can lead to session hijacking, privilege escalation, backdoor injection, and full system compromise.

Recommendations Update to version 0.16.2.