Is CVE-2026-49436 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49436 being exploited in the wild.

How severe is CVE-2026-49436?

High severity, with a CVSS score of 7.3, published 20 August 2026.

Is there a fix for CVE-2026-49436?

A patch was published on 2026-05-28: Version 2.5.7 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49436 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-49436?

Check whether you run Kovah LinkAce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49436: LinkAce stored cross-site scripting in Bulk Link API

CVE-2026-49436 · Severity: high · CVSS 7.3 · Published 2026-08-20

LinkAce is a self-hosted application that allows users to archive and organize website links. Authenticated users can exploit the Bulk Link API endpoint to inject malicious JavaScript URIs (javascript: scheme) that are stored and later executed in other users' browsers when clicked, allowing attackers to steal session tokens, cookies, and potentially impersonate administrators.

Technologies: Kovah LinkAce. Vendors: Kovah.

Quick answers

Is CVE-2026-49436 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49436 being exploited in the wild.
How severe is CVE-2026-49436?: High severity, with a CVSS score of 7.3, published 20 August 2026.
Which products and versions are affected?: Kovah LinkAce <2.5.7.
Is there a fix for CVE-2026-49436?: A patch was published on 2026-05-28: Version 2.5.7 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49436 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-49436?: Check whether you run Kovah LinkAce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a stored cross-site scripting (XSS) flaw in the Bulk Link API endpoint (POST /api/v2/bulk/links). The root cause is missing URL format validation in the BulkStoreLinksRequest class—while the web form correctly rejects non-standard URL schemes using Laravel's built-in "url" validation rule, the API endpoint accepts any string as a URL with only a "required" check. The stored javascript: URI is rendered verbatim in Blade templates via {{ $link->url }}, which escapes only HTML special characters but not URI schemes. An authenticated attacker can POST a JSON payload containing javascript:alert(document.cookie) to store a malicious link; when another user (including an admin) clicks the link, arbitrary JavaScript executes in their browser. Exploitation requires authentication and user interaction (clicking the link), but has high impact: session hijacking and admin account takeover. Version 2.5.7 patches the issue by adding URI scheme validation to the Bulk API endpoint.

Affected products

Kovah LinkAce <2.5.7

Timeline

2026-05-28: advisory: GitHub Security Advisory GHSA-6r73-pchm-4m39 published
2026-08-20: disclosed: CVE-2026-49436 published on NVD
2026-05-28: patched: Version 2.5.7 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.