CVE-2026-49436: LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API
LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (POST /api/v2/bulk/links) accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser — exfiltrating cookies and session tokens. Version 2.5.7 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LinkAceto a version that resolves this vulnerability.Fixed in 2.5.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated LinkAce account and access to the Bulk Link API endpoint. They can submit a link whose URL uses the javascript: scheme.
What user interaction is required for impact?
A victim must click the stored malicious link after it is rendered in a LinkAce Blade template. The JavaScript then executes in the victim's browser and can exfiltrate cookies and session tokens.
Which versions are affected and what fixes it?
LinkAce versions before 2.5.7 are affected. Version 2.5.7 fixes the issue.