CVE-2026-110225: Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route
Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with openshaarli exposing this to any visitor.
Affected Software
Event History
Frequently Asked Questions
Does exploitation normally require an authenticated account?
Yes. The issue allows authenticated users to cause server-side requests by creating bookmarks that point to internal addresses and triggering thumbnail retrieval.
When can an unauthenticated visitor trigger the issue?
In open_shaarli mode, thumbnail fetching is exposed to any visitor, so authentication is not required in that configuration.
What server-side targets can be reached?
A user can supply bookmark thumbnail targets such as loopback addresses, private network addresses, or cloud metadata addresses. The resulting requests are blind GET requests.