CVE-2025-55291: Shaarli allows reflected XSS via searchtags parameter
Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the </title> tag to be prematurely closed, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability is fixed in 0.15.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55291?
CVE-2025-55291 has a medium severity rating due to its potential to facilitate Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2025-55291?
To fix CVE-2025-55291, update Shaarli to version 0.15.0 or later, which includes the necessary input sanitization.
What type of vulnerability is CVE-2025-55291?
CVE-2025-55291 is classified as a reflected Cross-Site Scripting (XSS) vulnerability.
What are the potential risks of CVE-2025-55291?
Exploitation of CVE-2025-55291 could allow an attacker to inject malicious scripts into web pages viewed by other users.
Who is affected by CVE-2025-55291?
CVE-2025-55291 affects users of Shaarli versions prior to 0.15.0.