CVE-2026-48823

What it is

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the tag filtering functionality of Shaarli. An authenticated user can inject arbitrary JavaScript into the tags field when creating a bookmark (Shaare). The malicious payload is stored and later executed when users interact with the "Filter by tag" search feature on the homepage. User-supplied input in the tags field is not properly sanitized or output-escaped before being rendered in the tag filtering interface. When a bookmark is created with a malicious payload inside the tag field, the payload is stored in the database. Later, when a user searches using the "Filter by tag" functionality on the homepage, the application renders matching tags dynamically. If the tag value contains HTML with JavaScript event handlers, it is injected into the DOM. This impacts anyone interacting with the "Filter by tag" search functionality, administrators and privileged users. This issue has been fixed in version 0.16.2.

At a glance

Exploitability

Can be exploited locally on the machine with an admin-level account, but needs a user to act. High risk of data exposure.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-06-17 20:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-18 14:17 UTC Last updatedMost recent change to the record

Details

Published

2026-06-17 20:17 UTC

Last modified

2026-06-18 14:17 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Deferred

Attack profile CVSS 3.1 · 4.8

Attack vector

Local

Complexity

Low

Privileges needed

High

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None