CVE-2026-50190

Name of the Vulnerable Software and Affected Versions Shaarli versions prior to 0.16.3

Description Stored Cross-Site Scripting (XSS) occurs in the application/front/controller/visitor/BookmarkListController.php file. The permalink handler incorporates the raw $bookmark->getTitle() into the pagetitle template variable, which is then rendered into the document <title> element without HTML escaping. An attacker can inject a payload such as </title><script>...</script> into a bookmark title to execute arbitrary scripts in the Shaarli origin for any visitor accessing the /shaare/{hash} endpoint. Because the metadata fetcher copies remote page titles verbatim, an attacker can host a malicious URL and convince an administrator to bookmark it, leading to a one-shot administrator account takeover.

Recommendations Update to version 0.16.3.