Executive brief
Shaarli is a self-hosted bookmarking service. A security flaw in its thumbnail synchronization feature allows a malicious bookmark title to execute unauthorized code in an administrator's browser. If an administrator triggers a thumbnail update, an attacker could potentially hijack their session, escalate privileges, or gain full control over the application instance.
Technical details
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Shaarli's Thumbnail Synchronizer. The backend 'ThumbnailsController::ajaxUpdate' method uses a 'raw' formatter that returns unescaped bookmark titles in JSON responses. The frontend 'thumbnails-update.js' script then processes this AJAX response and inserts the title into the DOM using 'innerHTML' without sanitization. An attacker can exploit this by creating a bookmark with a malicious payload in the title; when an administrator runs the thumbnail update process, the payload executes. This can lead to session hijacking and full administrative takeover. The issue is fixed in version 0.16.2 by properly sanitizing DOM insertions.
Affected products
- Shaarli Shaarli <= 0.16.1
Timeline
- 2026-05-23: patched: Version 0.16.2 released
- 2026-05-23: advisory: GitHub Security Advisory GHSA-mw63-f9qj-c5h3 published
- 2026-06-17: disclosed: CVE-2026-48821 published