Executive brief
Linkwarden is a self-hosted tool used by teams to collect and archive webpages. A security flaw allows an attacker to upload malicious files that, when viewed by other users, execute unauthorized code within their browser session. This could lead to the theft of sensitive login tokens, unauthorized access to archived data, or the ability to modify collections on behalf of the victim.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Linkwarden versions 2.14.0 and prior. The archive upload endpoint (POST /api/v1/archives/[linkId]?format=4) accepts HTML files without sanitizing JavaScript content, bypassing the protections used in other archival methods. When these files are retrieved via the GET handler, they are served with a 'text/html' Content-Type from the application's origin without a Content-Security-Policy (CSP) header. An attacker can exploit this to execute arbitrary JavaScript in the victim's browser, enabling session hijacking via access to session tokens and unauthorized data enumeration. As of publication, no official patch is available.
Affected products
- Linkwarden Linkwarden <= 2.14.0
Timeline
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-09: disclosed: NVD publication date