DEBIAN-CVE-2026-48821
Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vulnerability in the Thumbnail Synchronizer feature. When an administrator runs the thumbnail update process, malicious bookmark titles are returned via an AJAX response and inserted into the DOM using innerHTML without proper sanitization. The issue originates from the interaction between the backend thumbnail update endpoint and the frontend JavaScript responsible for rendering update progress. On the backend, the ThumbnailsController::ajaxUpdate method returns bookmark data formatted using the 'raw' formatter. This includes the unescaped bookmark title in the JSON response. On the client side, the script thumbnails-update.js processes this AJAX response and dynamically updates the progress interface. Administrators using the thumbnail synchronization feature are affected and exploitation could lead to session hijacking, privilege escalation, backdoor injection and full compromise. This issue has been fixed in version 0.16.2.
DEBIAN-CVE-2026-48821
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-48821
shaarli
Source reference: /affected/0/package/name
- Affected versions
- 0.12.1+dfsg-8
Source reference:
/affected/0/versions0.12.1+dfsg-8+deb12u1Source reference:
/affected/0/versions0.12.1+dfsg-8+deb12u2Source reference:
/affected/0/versions0.13.0+dfsg-1Source reference:
/affected/0/versions0.13.0+dfsg-2Source reference:
/affected/0/versions0.13.0+dfsg-3Source reference:
/affected/0/versions0.13.0+dfsg-4Source reference:
/affected/0/versions0.13.0+dfsg-5Source reference:
/affected/0/versions0.14.0+dfsg-1Source reference:
/affected/0/versions0.14.0+dfsg-2Source reference:
/affected/0/versions0.15.0+dfsg-1Source reference:
/affected/0/versions0.16.1+dfsg-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
shaarli
Source reference: /affected/1/package/name
- Affected versions
- 0.14.0+dfsg-1
Source reference:
/affected/1/versions0.14.0+dfsg-2Source reference:
/affected/1/versions0.14.0+dfsg-2+deb13u1Source reference:
/affected/1/versions0.15.0+dfsg-1Source reference:
/affected/1/versions0.16.1+dfsg-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "shaarli",
"purl": "pkg:deb/debian/shaarli?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"0.12.1+dfsg-8",
"0.12.1+dfsg-8+deb12u1",
"0.12.1+dfsg-8+deb12u2",
"0.13.0+dfsg-1",
"0.13.0+dfsg-2",
"0.13.0+dfsg-3",
"0.13.0+dfsg-4",
"0.13.0+dfsg-5",
"0.14.0+dfsg-1",
"0.14.0+dfsg-2",
"0.15.0+dfsg-1",
"0.16.1+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48821.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "shaarli",
"purl": "pkg:deb/debian/shaarli?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"0.14.0+dfsg-1",
"0.14.0+dfsg-2",
"0.14.0+dfsg-2+deb13u1",
"0.15.0+dfsg-1",
"0.16.1+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48821.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57181 · Revision 1
- Added to Heist Feed
- Publisher date