Executive brief
LinkAce is a self-hosted application that allows users to archive and organize website links. Authenticated users can exploit the Bulk Link API endpoint to inject malicious JavaScript URIs (javascript: scheme) that are stored and later executed in other users' browsers when clicked, allowing attackers to steal session tokens, cookies, and potentially impersonate administrators.
Technical details
This vulnerability is a stored cross-site scripting (XSS) flaw in the Bulk Link API endpoint (POST /api/v2/bulk/links). The root cause is missing URL format validation in the BulkStoreLinksRequest class—while the web form correctly rejects non-standard URL schemes using Laravel's built-in "url" validation rule, the API endpoint accepts any string as a URL with only a "required" check. The stored javascript: URI is rendered verbatim in Blade templates via {{ $link->url }}, which escapes only HTML special characters but not URI schemes. An authenticated attacker can POST a JSON payload containing javascript:alert(document.cookie) to store a malicious link; when another user (including an admin) clicks the link, arbitrary JavaScript executes in their browser. Exploitation requires authentication and user interaction (clicking the link), but has high impact: session hijacking and admin account takeover. Version 2.5.7 patches the issue by adding URI scheme validation to the Bulk API endpoint.
Affected products
- Kovah LinkAce <2.5.7
Timeline
- 2026-05-28: advisory: GitHub Security Advisory GHSA-6r73-pchm-4m39 published
- 2026-08-20: disclosed: CVE-2026-49436 published on NVD
- 2026-05-28: patched: Version 2.5.7 released with fix