# CVE-2026-105263: Shaarli server-side request forgery in admin metadata endpoint

Source: https://junglewise.ai/threats/cve-2026-105263-a-security-flaw-has-been-discovered-in-shaarli-up-to-0-16-3-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105263 · Severity: medium · CVSS 4.7 · Published 2026-10-05

Shaarli is a minimalist bookmark management service that allows users to save and organize links. A server-side request forgery vulnerability in the admin metadata endpoint allows attackers to make the server fetch arbitrary URLs, potentially accessing internal systems or services that should not be publicly reachable. An authenticated admin attacker could exploit this to probe internal network infrastructure or retrieve sensitive data from the server's local network.

Technologies: [Shaarli](https://junglewise.ai/threats/technologies/shaarli). Vendors: [Shaarli](https://junglewise.ai/threats/vendors/shaarli).

## Quick answers

**Is CVE-2026-105263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105263 being exploited in the wild.

**How severe is CVE-2026-105263?** Medium severity, with a CVSS score of 4.7, published 5 October 2026.

**Which products and versions are affected?** Shaarli up to 0.16.3.

**Is there a fix for CVE-2026-105263?** Yes: fixed in 0.16.4. Until then: Restrict access to the /admin/metadata endpoint at the web server or firewall level, or ensure only trusted administrators have access to the admin panel. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105263 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105263?** Check whether you run Shaarli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.16.4

Restrict access to the /admin/metadata endpoint at the web server or firewall level, or ensure only trusted administrators have access to the admin panel.

## Technical details

The MetadataController's URL parameter lacks proper validation, allowing server-side request forgery through weak scheme validation (substring rather than exact matching) and no IP filtering for private/loopback ranges. An attacker with admin access can submit requests to the /admin/metadata endpoint that cause the server to fetch URLs from internal networks (RFC 1918 addresses, loopback, link-local). The vulnerability also lacks CSRF protection on the GET endpoint, enabling cross-site exploitation of logged-in administrators.

## Affected products

- Shaarli Shaarli up to 0.16.3

## Timeline

- 2026-10-05: disclosed

## References

- [https://github.com/shaarli/Shaarli/](https://github.com/shaarli/Shaarli/)
- [https://github.com/shaarli/Shaarli/commit/8ca4de8e7c932a684481f5fbb1229fe16de1f4d2](https://github.com/shaarli/Shaarli/commit/8ca4de8e7c932a684481f5fbb1229fe16de1f4d2)

## Related threats

- [Shaarli stored XSS in bookmark title on permalink](https://junglewise.ai/threats/cve-2026-50190-shaarli-stored-xss-in-bookmark-title-on-permalink)
- [Shaarli DOM-based XSS in Thumbnail Synchronizer](https://junglewise.ai/threats/cve-2026-48821-shaarli-dom-based-xss-in-thumbnail-synchronizer)
- [Shaarli stored XSS in tag filtering functionality](https://junglewise.ai/threats/cve-2026-48823-shaarli-stored-xss-in-tag-filtering-functionality)
- [Shaarli stored XSS in Markdown reference links](https://junglewise.ai/threats/cve-2026-48822-shaarli-stored-xss-in-markdown-reference-links)